Gems You Might Not Need - Authentication and Authorization

Transcript

1. Gems You Might Not Need Authentication and Authorization

2. Authentication Who are you? Authorization Are you allowed to do

   that?

3. Do I need an authentication gem? Maybe not...

4. has_secure_password • Built in to newer versions of Rails •

   Adds methods to set and authenticate against a BCrypt password. • This mechanism requires you to have a password_digest attribute. https://gist.github.com/2252946

5. Invitations • Add an invitation_token string attribute to your model

   • Generate the token with ActiveSupport:: SecureRandom.hex https://gist.github.com/2253047

6. Do I need an authorization gem? Maybe not...

7. Before filters • Methods with redirects https://gist.github.com/2253206

8. Before filters - a step further • Stay flexible to

   meet needs https://gist.github.com/3f28fd45a9755dfafd72

9. The Forbid pattern • When you need to get more

   granular than before filters • class ForbiddenError < StandardError • rescue_from ForbiddenError https://gist.github.com/2253303

10. The Forbid pattern - a step further • Stay flexible

    to meet business needs https://gist.github.com/2253352

11. The End • Simple • Flexible • Easy to understand