ruby! food! kids! … and other fun from terry heath
RSS icon Email icon Home icon

  • Rails and OpenID: Start Your Engines

    Posted on September 4th, 2009 terry 12 comments

    (Apologies for the ridiculously lame title, but I laughed while writing it, so it stays.)

    If you care about your user’s security, and your time, it’s time you stop asking them for passwords. Storing user passwords and handling authentication offers a bunch of problems that have already been solved, and requires a lot of work to do it right.

    Think about it. If you’re storing user’s passwords in your database, you’ve automatically got sensitive information on your server. Maybe it’s just a College Football Pick ‘Em site, which stores nothing too important … until you store a user’s password. Let’s face it, most users don’t use a new password for every site, so if someone breaks into your server, you’re responsible if that information is lost.

    So, you’ve got to make sure your server’s security is up to date. Then, it’s still possible there’s a break in, or you have a malicious developer. So you have to encrypt the passwords. But not just encrypt them, because that would still be susceptible to dictionary attacks. You have to salt each password.

    What about brute force login attempts on your sign in page? Have you handled that?

    These are just some of the problems that you have to solve the minute you decide to store someone’s password.

    A better solution? OpenID. Below I’ll explain how to use my newly written (really repackaged) OpenID Rails engine, and you can be on your way to making the world an easier place to sign in.

    Before you do anything, you’ll need to install the ruby-openid gem. Just do this:

    sudo gem install ruby-openid

    I’m going to do this with a brand new Rails (needs to be >= 2.3) app. So, to start things up:

    rails wutzit

    Next, since the engine is in its infancy, it requires a User model:

    script/generate model user

    This is technically all that has to be done to use the engine. So, let’s put that in:

    script/plugin install git://github.com/terrbear/openid_engine.git

    There are a few steps that the engine requires to work (until engines better support migrations). They take about 3 seconds, though. First, create the OpenID auth tables:

    rake open_id_authentication:db:create
rake db:migrate

    And then add a default route to your routes.rb (be sure to remove public/index.html!), something like:

    map.root :controller => "welcome"

    Of course, if we do that, we’ll need a welcome controller.

    script/generate controller welcome

    Let’s add a little bit of code to test out the welcome controller and the OpenID goodness:

    class WelcomeController < ActionController::Base   
  before_filter :signin_required   
  def hello     
    render(:text => "hello, #{current_user.identity_url}")
  end
end

    Then fire up your server and try to log in. You should be greeted by this gorgeous screen:

    Log in, and you have an authenticated user, using OpenID!

    If you introduce validations to your user, and define edit_user_url with resources or a named route in your routes.rb, new users will be automagically redirected to the edit page after they create an account.

    , , , , ,
     

    11 responses to “Rails and OpenID: Start Your Engines” RSS icon


    1 Trackbacks / Pingbacks

Powered by WordPress
Designed by My Mobiles