240 Authentication [3d]

Authentication is all about being able to verify the identity of a user in the context of our application.

Important

Work on this lesson in advisor mode.

While you could roll out a custom authentication solution, this would likely expose you to the various risks of "homegrown crypto". In practice we are using popular authentication libraries like clearance Show archive.org snapshot or devise Show archive.org snapshot for this task.

Learning goals

• You can explain what authentication is and how it differs from authorization.
• You can explain how a user stays signed in across requests, and how cookies and the session make that work.
• You can explain how passwords are stored safely — hashed and salted — and why plaintext or reversible storage is never acceptable.
• You can explain why we use a proven library instead of a homegrown solution, and what "homegrown crypto" risks.
• You can add sign-up, login and logout to a Rails app with our default library (Clearance), adapt its views to the app, and deny access to signed-out users by default rather than per controller.
• You can attach records to the signed-in user and test the whole authentication flow.
• You can assess the security of an authentication implementation: brute force against the database, session hijacking over the network, a new controller that forgot the check.

Resources

Read what's new to you, skim what's familiar, skip what you already master. Stop when you can meet the learning goals.

Your agent can also generate an overview, a tutorial or an explanation for anything here, tailored to what you already know. Just ask.

• 📄 Rails Authentication from Scratch Show archive.org snapshot — Steve Polito; read it to understand the mechanics, don't write the code
• 📄 has_secure_password Show archive.org snapshot — Rails API: how passwords are hashed with bcrypt
• 📄 Password Storage Cheat Sheet Show archive.org snapshot — OWASP: hashing, salting, and why plaintext or reversible storage is never acceptable
• 📄 Clearance README Show archive.org snapshot — our default library; read it before the exercise
• 📄 Rails Authentication: Gems vs. Recipes vs. Generators Show archive.org snapshot — Joe Masilotti; a balanced comparison of Devise, Clearance-style gems, hand-rolled recipes and Rails 8's generator
• 📄 Authentication with Devise — our card for the projects that use Devise (internal)

Questions to answer while reading

• How does a user stay signed in across multiple requests after submitting the login form only once?
• How can we authenticate a user without storing their plaintext password in our database?
• How can we authenticate a user without storing their plaintext password in a cookie?
• How could you make the movies' show view only accessible for authenticated users?
• How does logout work?

Exercises

Authentication with Clearance

Add a User model to the MovieDB application. A User should have:

• E-mail address
• Screen name

Now add the following features to MovieDB using the clearance Show archive.org snapshot gem.

• User can sign up through a public registration form
• User can login with the correct password
• User can logout
• Movie gets an association Movie#creator which points to the user who created that movie. This is a required field.
• A movie's show view links to the user profile
• The user profile shows the list of movies created by that user
• Deny access to all MovieDB pages except for logged in users
• The views provided by Clearance should be customized to work with the existing form styles in your MovieDB.

Add tests for all these features.

Discussion

Discuss the implementation with your mentor, with an emphasis on security. Some questions to answer are:

• Is access for signed out users really impossible? If you add a new controller, do you have to remember to secure it as well?
• Can you find out a user's password by looking into the database?
• Are passwords "salted"?
• How hard is it to brute-force passwords, if you have access to the database?
• Can you sign out a user using the Rails console?
• If someone can read our network traffic, can he see a user's password? Can he hijack her session?

Password reset

You don't need to implement password reset as part of this card. However, let your mentor show you how a password reset feature is implemented and tested in an existing app.

Alternatives

• Devise is the most widely used authentication gem and you will meet it in some of our projects. It does more out of the box (confirmation, lockout, OmniAuth) at the price of more configuration and generated code. See Authentication with Devise.
• Rails' built-in generator (rails generate authentication, since Rails 8) gives you a minimal sessions + password reset implementation to own yourself. Fine for tiny apps; we prefer a maintained library. See Our Rails stack.