authlogic

Authlogic An unobtrusive ruby authentication library based on ActiveRecord. Documentation Version Documentation Unreleased https://github.com/binarylogic/authlogic/blob/master/README.md 6.6.1 https://github.com/binarylogic/authlogic/blob/v6.6.1/README.md 6.5.0 https://github.com/binarylogic/authlogic/blob/v6.5.0/README.md 6.4.3 https://github.com/binarylogic/authlogic/blob/v6.4.3/README.md 5.2.0 https://github.com/binarylogic/authlogic/blob/v5.2.0/README.md 4.5.0 https://github.com/binarylogic/authlogic/blob/v4.5.0/README.md 3.7.0 https://github.com/binarylogic/authlogic/blob/v3.7.0/README.md 2.1.11 https://github.com/binarylogic/authlogic/blob/v2.1.11/README.rdoc 1.4.3 https://github.com/binarylogic/authlogic/blob/v1.4.3/README.rdoc Table of Contents 1. Introduction 1.a. Overview 1.b. Reference Documentation 1.c. Installation 2. Rails 2.a. The users table 2.b. Controller 2.b.1. Helper Methods 2.b.2. Routes 2.b.3. ActionController::API 2.c. View 2.d. CSRF Protection 3. Testing 4. Helpful links 5. Add-ons 6. Internals 7. Extending 90. Compatibility 1. Introduction 1.a. Overview Authlogic introduces a new type of model. You can have as many as you want, and name them whatever you want, just like your other models. In this example, we want to authenticate with our User model, which is inferred from the name: class UserSession < Authlogic::Session::Base # specify configuration here, such as: # logout_on_timeout true # ...many more options in the documentation end In a UserSessionsController, login the user by using it just like your other models: UserSession.create(:login => "bjohnson", :password => "my password", :remember_me => true) session = UserSession.new(:login => "bjohnson", :password => "my password", :remember_me => true) session.save # requires the authlogic-oid "add on" gem UserSession.create(:openid_identifier => "identifier", :remember_me => true) # skip authentication and log the user in directly, the true means "remember me" UserSession.create(my_user_object, true) The above handles the entire authentication process for you by: authenticating (i.e. validating the record) sets up the proper session values and cookies to persist the session (i.e. saving the record). You can also log out (i.e. destroying the session): session.destroy After a session has been created, you can persist it (i.e. finding the record) across requests. Thus keeping the user logged in: session = UserSession.find To get all of the nice authentication functionality in your model just do this: class User < ApplicationRecord acts_as_authentic do |c| c.my_config_option = my_value end # the configuration block is optional end It is also "smart" in the sense that if a login or username field is present it will use that to authenticate, if not it will look for an email field. This is all configurable, but for 99% of cases the above is all you will need to do. You may specify how passwords are cryptographically hashed (or encrypted) by setting the Authlogic::CryptoProvider option: c.crypto_provider = Authlogic::CryptoProviders::BCrypt Also, sessions are automatically maintained. You can switch this on and off with configuration, but the following will automatically log a user in after a successful registration: User.create(params[:user]) You can switch this on and off with the following configuration: class User < ApplicationRecord acts_as_authentic do |c| c.log_in_after_create = false end # the configuration block is optional end Authlogic also updates the session when the user changes his/her password. You can also switch this on and off with the following configuration: class User < ApplicationRecord acts_as_authentic do |c| c.log_in_after_password_change = false end # the configuration block is optional end Authlogic is very flexible, it has a strong public API and a plethora of hooks to allow you to modify behavior and extend it. Check out the helpful links below to dig deeper. 1.b. Reference Documentation This README is just an introduction, but we also have reference documentation. To use the reference documentation, you must understand how Authlogic's code is organized. There are 2 models, your Authlogic model and your ActiveRecord model: Authlogic::Session, your session models that extend Authlogic::Session::Base. Authlogic::ActsAsAuthentic, which adds in functionality to your ActiveRecord model when you call acts_as_authentic. 1.c. Installation To install Authlogic, add this to your Gemfile: gem 'authlogic' And run bundle install. 2. Rails Let's walk through a typical Rails setup. (Compatibility) 2.a.1 The users table If you want to enable all the features of Authlogic, a migration to create a User model might look like this: class CreateUser < ActiveRecord::Migration def change create_table :users do |t| # Authlogic::ActsAsAuthentic::Email t.string :email t.index :email, unique: true # Authlogic::ActsAsAuthentic::Login t.string :login # Authlogic::ActsAsAuthentic::Password t.string :crypted_password t.string :password_salt # Authlogic::ActsAsAuthentic::PersistenceToken t.string :persistence_token t.index :persistence_token, unique: true # Authlogic::ActsAsAuthentic::SingleAccessToken t.string :single_access_token t.index :single_access_token, unique: true # Authlogic::ActsAsAuthentic::PerishableToken t.string :perishable_token t.index :perishable_token, unique: true # See "Magic Columns" in Authlogic::Session::Base t.integer :login_count, default: 0, null: false t.integer :failed_login_count, default: 0, null: false t.datetime :last_request_at t.datetime :current_login_at t.datetime :last_login_at t.string :current_login_ip t.string :last_login_ip # See "Magic States" in Authlogic::Session::Base t.boolea