Ruby on Rails Authentication Cheatsheet

From OWASP
Jump to: navigation, search

Secure user authentication in ruby on rails is discussed here.

Implementing authentication in a typical rails application is made easy and secure with devise gem.

Devise will solve for you the problems of secure password storage, secure sessions and authenticated-only access to specified

resource kinds.

Install it using:

   gem 'devise'

Then install it to the user model:

   rails generate devise:install

Next, specify which resources (routes) require authenticated access in your routes, config/routes.rb:

 1     Rails.application.routes.draw do
 2       authenticate :user do
 3         resources :something do  # these resource require authentication
 4          ...
 5         end
 6       end
 7   
 8       devise_for :users # sign-up/-in/out routes
 9 
10       root to: 'static#home' # no authentication required
11   
12     end

To make authentication secure, enforce higher password complexity and allow TLS connections only.

You can try out this PoC, to learn more about devise.

Note, that the authorized access to concrete resource objects (and not the classes of resources), is provided by other solutions, like e.g. CanCanCan.