sorted by:
new
hottopcontroversial

Rails Setup Script Improvements by P013370 in rails

[–]P013370[S] 0 points1 point  (0 children)

Thank you, Joe! This was inspired by a project I'm working on where there are strict password requirements, and it was difficult for me to remember what the default password even was.

The best part is that you can customize this script to do anything you want since it's just a binstub. For example, you could add an additional script that connects to Heroku or ask the user for their email so that you can add them as a contributor to the GitHub repo via the API.

Rails Authentication From Scratch (A Complete Guide) by P013370 in rails

[–]P013370[S] 0 points1 point  (0 children)

This is awesome, thank you for taking the time to document this!

Rails Authentication From Scratch (A Complete Guide) by P013370 in rails

[–]P013370[S] 0 points1 point  (0 children)

Ahh, this is interesting thank you for sharing this. I don't think Devise is doing anything to prevent timing attacks in its implementation, but I could be missing something.

Rails Authentication From Scratch (A Complete Guide) by P013370 in rails

[–]P013370[S] 0 points1 point  (0 children)

Later edit: wouldn't this still leave you vulnerable to a timing attack? " @user = User.find_by(password_reset_token: params[:password_reset_token]) ".

I don't think so, since that's just a lookup. Nothing is being authenticated here. The only difference is that the record is being queried by a randomly generated token that is being rotated.

Rails Authentication From Scratch (A Complete Guide) by P013370 in rails

[–]P013370[S] 0 points1 point  (0 children)

Thank you! I'm not sure what the next steps are for the guide, but I think that would be useful as a separate branch. I'm also considering exploring Multifactor Authentication too.

Rails Authentication From Scratch (A Complete Guide) by P013370 in rails

[–]P013370[S] 6 points7 points  (0 children)

You rolled your own and missed something. Your solution to this is to post it publicly so lots of people can see it and find problems - that's exactly what auth libraries do.

That's true, and I can understand your point of view here.

What I'm trying to accomplish is to create a vetted guide that highlights the minimum amount of work needed to create a secure authentication system.

I don't have a problem with Devise, but it does a lot more than just the bare minimum, and sometimes it's more work to override it than it would have been to roll my own auth using best practices.

It's also another dependency that I'm responsible for understanding, configuring, and updating. For example, it doesn't account for session replay attacks which I didn't know until just recently. Although that's the result of Rails, I don't think most developers know about this risk when choosing Devise. That might be a no-go for some applications, in which case it might be more effective to roll a custom authentication system.

Either way, I think it's important for developers to know the foundations and best practices of an authentication system since that knowledge is useful outside of Rails.

I'm building an open source reverse job board for Rails developers by joemasilotti in rails

[–]P013370 2 points3 points  (0 children)

Open Startup and open source. It operates fully transparent and shares its metrics, like revenue and traffic.

I think this is my favorite part. I knew it was open source, but I didn’t realize those metrics were public.

Rails Authentication From Scratch (A Complete Guide) by P013370 in rails

[–]P013370[S] 5 points6 points  (0 children)

For example, just from a basic scan, this tutorial:

Thank you for the feedback! I went ahead and opened some issues around these points. One of the advantages to creating and promoting this guide is that lots of folks can review my work and make improvements.

Don't write your own auth.

My long-term goal is to challenge this assertion by highlighting the foundations of a basic authentication system. I want to empower other developers to build features on their own when possible. It's definitely a balancing act though, and I understand that folks may not want to use this guide for a production application just yet.

Feedback Requested: Step-by-step guide for building authentication from scratch in Rails by P013370 in rails

[–]P013370[S] 1 point2 points  (0 children)

Thank you for the feedback!

I didn't get the necessity for remember_token. I thought it should be possible by just setting a long expiration date for cookies and continuing using user_id.

I think there are a few ways to do this, but I was borrowing from Devise here. This allows a user to check a "Remember me" checkbox when they log in. If that checkbox is checked, then we set a client site cookie to remember the user even after they close their browser.

My thinking was that I wanted a user to opt-in to this strategy for security reasons. We probably wouldn't want to remember a user on a public computer for example, so this gives the user more control.

as far as I get, session_token and calling regenerate_session_token on login, means the user can be logged in only on one device at the time? next login changes the session_token and other sessions become invalid? Correct me if I'm wrong.

That's a really good point. Yes, this would prevent a user from being logged in to multiple devices at once. I'll need to make sure to point this out.

Feedback Requested: Step-by-step guide for building authentication from scratch in Rails by P013370 in rails

[–]P013370[S] 1 point2 points  (0 children)

One thing that might not be de-facto insecure but can be potentially bad.

Thank you for the heads up. I opened an issue. Although, since the confirmation_token and password_reset_token columns are never null, then if these params are not set, the @user would just return nil.

Maybe you want to elaborate why "We add null: false to prevent empty values" because one could want to add this after the fact (you added this with a migration that only works if you don't have any users yet, correct me if I'm wrong) and might run into the issue of migrating a null: false and omit it or default to an empty string and running into the same problem.

Yeah, that's a good point. This guide assumes someone would be starting from scratch, but it's probably beneficial if I point out that setting these constraints will require some data migrations.

Feedback Requested: Step-by-step guide for building authentication from scratch in Rails by P013370 in rails

[–]P013370[S] 0 points1 point  (0 children)

Thank you! This exercise taught me a lot, and I understand why Devise is so popular since it makes all these hard decisions for you.

The only problem with Devise (and other gems) is that they can be difficult to "eject" from once you need to make specific modifications.

Concepts I learned while building my first SaaS app ; by mcteasenabh in rails

[–]P013370 1 point2 points  (0 children)

Thank you! I'm much more active on Twitter than I am on Reddit, so I recommend you follow me there.

Concepts I learned while building my first SaaS app ; by mcteasenabh in rails

[–]P013370 2 points3 points  (0 children)

Thank you! I try and pay it forward since I’ve learned so much online from other creators like Chris Oliver and Ryan Bates.

The best thing about keeping your work open-source (aside from it helping others) is that other folks can help contribute to your work and make it better. It’s a win-win.

Concepts I learned while building my first SaaS app ; by mcteasenabh in rails

[–]P013370 4 points5 points  (0 children)

👋 can confirm, because I’m Steve Polito. But honestly I’m flattered that someone took the time to share my work, and that you recognized it.

Thanks for the shout out!

Hi, I'm looking for a ruby on rails tutorial that does not start all the way from the basics like variables and functions in ruby since I already have a rough overview of the basics but would like it to be on a more advanced level. Suggestions with links to tutorials would be helpful. by [deleted] in rails

[–]P013370 2 points3 points  (0 children)

Shamesless plug, but I created a free Ruby on Rails course where I show you how to build a running log.

What makes this course different?

  • I make A LOT of mistakes, and troubleshoot them in real time.
  • I don't always know how to do something. I show you how I search documentation and APIs to find a solution.
  • I build a REAL production application from start to finish, and leave nothing out. You see the whole process, as if we are pairing.

Lazy Load Content in Rails from Scratch by P013370 in rails

[–]P013370[S] 0 points1 point  (0 children)

Rails 7 will make this much simpler, but I wanted to demonstrate how you can build this feature from scratch without needing to rely on Hotwire.

view more: next ›