rails-authentication-from-scratch
Rodauth
rails-authentication-from-scratch | Rodauth | |
---|---|---|
13 | 19 | |
216 | 1,626 | |
- | - | |
1.8 | 8.2 | |
12 months ago | 10 days ago | |
Ruby | Ruby | |
- | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
rails-authentication-from-scratch
-
What is your favorite authentication solution?
You can certainly roll your own authentication with Rails and feel very confident about it. One such example: https://stevepolito.design/blog/rails-authentication-from-scratch
-
Found this absolute gem of a function in the company repo, file is called "login_system.js"
The owasp cheatsheet is probably the best resource https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html, there's also this rails tutorial https://stevepolito.design/blog/rails-authentication-from-scratch that incorporates some (but not all) good practices that covers implementation details, but are broadly applicable to any language and framework
- Rails Authentication from Scratch
-
Time to think about swapping off Devise?
Devise not being Hotwire compatible is a huge turnoff for me. Honestly if I were staring a new project today I’d probably go with a “hand rolled” authentication. I haven’t done it myself but I know a lot of thought was put into this guide if you were interested in that route: https://stevepolito.design/blog/rails-authentication-from-scratch/
- Authentication Question
-
Rails 7.1 adds authenticate_by when using has_secure_password
For those who are interested in building their own authentication, I would also recommend reading https://stevepolito.design/blog/rails-authentication-from-scratch/
-
So you Want to use auth?
I will not go fully in detail about how to make your own Authentication from scrap, although a really useful blog that does do that can be found here. I will be going over the logic behind it.
-
Authentication Zero - rails g authentication user
This looks promising and I'd love to have the full control on my application. And recently I went through this repo https://github.com/stevepolitodesign/rails-authentication-from-scratch with a lot of details on how Devise works under the hood. It makes it really easy to understando all the different chunks of code and how the work all together.
-
Rails Authentication From Scratch (A Complete Guide)
Thank you for the feedback! I went ahead and opened some issues around these points. One of the advantages to creating and promoting this guide is that lots of folks can review my work and make improvements.
- How do I lock down my API so only requests are allowed from the Android app?
Rodauth
-
Warden of Hanami - hanami.rb basic authentication
There is no Hanami specific authentication library. Rails has a plethora of solutions, but nothing was created for Hanami (at least for the current version). There are framework agnostic tools though. OAuth solutions are like that, JWT, libraries like Rodauth. The last one is particularly interesting for Hanami since it is very much in the same "spirit" in terms of design and it is also the most advanced solution on the ruby market.
-
Passkey Authentication with Rodauth
Rodauth provides first class support for passkeys, implemented on top of the excellent webauthn-ruby gem. It enables using passkeys as a multifactor authentication method, or for passwordless login and registration. In addition to routes, views and database storage, it also provides the complete JavaScript part that interacts with Web Authentication API for zero configuration.
- Rodauth: Ruby's Most Advanced Authentication Framework
-
why is devise industry standard?
I can recommend rodauth: https://github.com/jeremyevans/rodauth It ships with a ton of things. Check out the features section.
-
A First Look at Hanami 2 for Ruby
In general, even though the Hanami ecosystem lacks any "plug-and-play" solutions such as Devise, you can use many existing libraries not tightly coupled to Ruby on Rails. For authentication, you can use Warden, OmniAuth or Rodauth. For uploads there is Shrine. The pagination is built into ROM. Integration with exception catchers such as Rollbar is easy.
-
Social Login in Rails with Rodauth
While Devise provides a convenience layer around OmniAuth, it does nothing to actually sign the user into your app. When I started writing the OmniAuth integration for Rodauth, I wanted to go one step further and actually handle things like persistence of external identities, account creation and login, while still allowing the developer to customize the behaviour. That's how rodauth-omniauth was created. ✨
-
Time to think about swapping off Devise?
You can find the list of possible error identifiers here.
-
I’ve started discussion + work on updating Devise to support passkeys; we need contributors!
You probably meant the webauthn_login, which already supports passwordless.
-
What It Took to Build a Rails Integration for Rodauth
When Rodauth came out, I was excited to finally have a full-featured authentication framework that wasn't tied to Rails, given that existing solutions required either Rails (Devise, Sorcery), or at least Active Record (Authlogic). Even though I mainly develop in Rails, I want other Ruby web frameworks to be viable alternatives, so I'm naturally drawn to generic solutions that everyone can use.
What are some alternatives?
warden - General Rack Authentication Framework
Devise - Flexible authentication solution for Rails with Warden.
rodauth-rails - Rails integration for Rodauth authentication framework
OmniAuth - OmniAuth is a flexible authentication system utilizing Rack middleware.
authentication-zero - An authentication system generator for Rails applications.
OAuth2 - A Ruby wrapper for the OAuth 2.0 protocol.
JWT - A ruby implementation of the RFC 7519 OAuth JSON Web Token (JWT) standard.
warden-github-rails - Use GitHub as authorization and more. Use organizations and teams as means of authorization by simply wrapping your rails routes in a block. Also useful to get a user's details through OAuth.
Doorkeeper - Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.
Authlogic - A simple ruby authentication solution.
passwordless - 🗝 Authentication for your Rails app without the icky-ness of passwords