BostonRB - January 2014 - Devise - Bob Breznak

My presentation at the January 2014 BostonRB meetup. I discussed the inner workings of Devise by reviewing Rack and Warden then dove into a problem that we addressed in Devise.

Transcript

1. Devise @bobbrez
2. Rack Warden Devise Token Authentication
3. Rack
4. Rack Example https://github.com/bobbrez/bostonrb_rack_talk
5. Application Middleware B Middleware D Middleware C Middleware A
6. Application Middleware B Middleware D Middleware C Middleware A Some Request
7. Application Middleware B Middleware D Middleware C Middleware A Some Request
8. Application Middleware B Middleware D Middleware C Middleware A Some Request
9. Application Middleware B Middleware D Middleware C Middleware A Some Request
10. Application Middleware B Middleware D Middleware C Middleware A Some Request
11. Application Middleware B Middleware D Middleware C Middleware A Some Response
12. Application Middleware B Middleware D Middleware C Middleware A Some Response
13. Application Middleware B Middleware D Middleware C Middleware A Some Response
14. Application Middleware B Middleware D Middleware C Middleware A Some Response
15. Application Middleware B Middleware D Middleware C Middleware A Some Response
16. Application Middleware B Middleware D Middleware C Middleware A
17. Application Middleware B Middleware D Middleware C Middleware A
18. Application Middleware B Middleware D Middleware C Middleware A Some Request
19. Application Middleware B Middleware D Middleware C Middleware A Some Request
20. Application Middleware B Middleware D Middleware C Middleware A Some Request
21. Application Middleware B Middleware D Middleware C Middleware A Some Response X
22. Application Middleware B Middleware D Middleware C Middleware A Some Response
23. Application Middleware B Middleware D Middleware C Middleware A Some Response
24. Application Middleware B Middleware D Middleware C Middleware A
25. Application Location: /facts Params: {}
26. Application
27. Application
28. Application Content-Type: text Cats can rotate their ears 180 degrees each, independently.
29. Application Caps Location: /facts Params: {}
30. Application Caps Location: /facts Params: {}
31. Application Caps Content-Type: text Cats can rotate their ears 180 degrees each, independently.
32. Application Caps Content-Type: text CATS CAN ROTATE THEIR EARS 180 DEGREES EACH, INDEPENDENTLY.
33. Application Caps JSON Location: /facts.json Params: {}
34. Application Caps JSON Location: /facts Params: {}
35. Application Caps JSON Location: /facts Params: {}
36. Application Caps JSON Content-Type: text Cats can rotate their ears 180 degrees each, independently.
37. Application Caps JSON Content-Type: text CATS CAN ROTATE THEIR EARS 180 DEGREES EACH, INDEPENDENTLY.
38. Application Caps JSON Content-Type: application/json { “fact”: “CATS CAN ROTATE THEIR EARS 180 DEGREES EACH, INDEPENDENTLY.” }
39. Application Kanye Caps JSON Location: /facts.json Params: { }
40. Application Kanye Caps JSON Location: /facts.json Params: { }
41. Application Kanye Caps JSON Location: /facts.json Params: { }
42. Application Kanye Caps JSON Location: /facts.json Params: { }
43. Application Kanye Caps JSON Content-Type: text Cats can rotate their ears 180 degrees each, independently.
44. Application Kanye Caps JSON Content-Type: text CATS CAN ROTATE THEIR EARS 180 DEGREES EACH, INDEPENDENTLY.
45. Application Kanye Caps JSON Content-Type: application/json { “fact”: “CATS CAN ROTATE THEIR EARS 180 DEGREES EACH, INDEPENDENTLY.” }
46. Application Kanye Caps JSON Content-Type: text { “fact”: “I'ma let you finish but CATS CAN ROTATE THEIR EARS 180 DEGREES EACH, INDEPENDENTLY.” }
47. Application Kanye Caps JSON Auth Location: /facts/premium Params: { token: ‘12345’ }
48. Application Kanye Caps JSON Auth Location: /facts/premium Params: { token: ‘12345’ } env[‘user’] = { name: ‘Bob’ }
49. Application Kanye Caps JSON Auth Location: /facts/premium Params: { token: ‘12345’ } env[‘user’] = { name: ‘Bob’ }
50. Application Kanye Caps JSON Auth Location: /facts/premium Params: { token: ‘12345’ } env[‘user’] = { name: ‘Bob’ }
51. Application Kanye Caps JSON Auth Location: /facts/premium Params: { token: ‘12345’ } env[‘user’] = { name: ‘Bob’ }
52. Application Kanye Caps JSON Auth Content-Type: text Bob, Cats can rotate their ears 180 degrees each, independently.
53. Application Kanye Caps JSON Auth Content-Type: text BOB, CATS CAN ROTATE THEIR EARS 180 DEGREES EACH, INDEPENDENTLY.
54. Application Kanye Caps JSON Auth Content-Type: text BOB, CATS CAN ROTATE THEIR EARS 180 DEGREES EACH, INDEPENDENTLY.
55. Application Kanye Caps JSON Auth Content-Type: text I’MA LET YOU FINISH BUT BOB, CATS CAN ROTATE THEIR EARS 180 DEGREES EACH, INDEPENDENTLY.
56. Application Kanye Caps JSON Auth Content-Type: text I’MA LET YOU FINISH BUT BOB, CATS CAN ROTATE THEIR EARS 180 DEGREES EACH, INDEPENDENTLY.
57. Application Kanye Caps JSON Auth Location: /facts/premium Params: { token: ‘bad token’ }
58. Application Kanye Caps JSON Auth Content-Type: text Sorry, you do not have access to superior feline trivia.
59. Warden
60. Application Auth Kanye Caps JSON
61. Application Warden Kanye Caps JSON
62. Application Warden
63. Application Warden
64. Application Warden Warden Manager Proxy Strategy Session
65. Application Warden Warden Manager Proxy Strategy Session Hooks in Warden Location: /facts/premium Params: { token: ‘12345’ }
66. Application Warden Warden Manager Proxy Strategy Session Hooks in Warden Location: /facts/premium Params: { token: ‘12345’ } env[‘warden’] => Warden::Proxy
67. Application Warden Warden Manager Proxy Strategy Session Hooks in Warden Location: /facts/premium Params: { token: ‘12345’ } env[‘warden’] => Warden::Proxy 1
68. Application Warden Warden Manager Proxy Strategy Session Warden “Client” 1 def call(env) env[‘warden’].authenticate! ...
69. Application Warden Warden Manager Proxy Strategy Session Warden “Client” 1 def call(env) env[‘warden’].authenticate! ... 2
70. Application Warden Warden Manager Proxy Strategy Session Warden “Client” 2 1 if user = session.fetch_user return user else run_strategies if winning_strategy && winning_strategy.user return winning_strategy.user end end
71. Application Warden Warden Manager Proxy Strategy Session Warden “Client” 2 1 if user = session.fetch_user return user else run_strategies if winning_strategy && winning_strategy.user return winning_strategy.user end end 3
72. Application Warden Warden Manager Proxy Strategy Session User <=> ID ! Requires Session Middleware 2 1 3 def serialize(user) # User to a key (i.e. User.id) ... end ! def deserialize(key) # User from a key (i.e. User.find key ) ... end
73. Application Warden Warden Manager Proxy Strategy Session User <=> ID ! Requires Session Middleware 2 1 3 4 def serialize(user) # User to a key (i.e. User.id) ... end ! def deserialize(key) # User from a key (i.e. User.find key ) ... end
74. Application Warden Warden Manager Proxy Strategy Session Authentication logic 2 1 3 4 def authenticate! # Auth logic ... end
75. Application Warden Warden Manager Proxy Strategy Session Authentication logic 2 1 3 4 def authenticate! throw :warden end
76. Application Warden Warden Manager Proxy Strategy Session Authentication logic 2 1 3 4 def authenticate! throw :warden end 5
77. Application Warden Warden Manager Proxy Strategy Session Hooks in Warden 2 1 3 4 config.failure_app.call(env) # returns [401, {}, [‘Unauthenticated’]] 5
78. Application Warden Warden Manager Proxy Strategy Session Hooks in Warden 2 1 3 4 config.failure_app.call(env) # returns [401, {}, [‘Unauthenticated’]] 5 6
79. Application Warden Warden Manager Proxy Strategy Session Authentication logic 2 1 3 4 def authenticate! user = ... # some method to find a user success! user end
80. Application Warden Warden Manager Proxy Strategy Session Authentication logic 2 1 3 4 def authenticate! user = ... # some method to find a user success! user end 5
81. Application Warden Warden Manager Proxy Strategy Session Authentication logic 2 1 3 4 store( serialize( user ) ) 5
82. Application Warden Warden Manager Proxy Strategy Session Authentication logic 2 1 3 4 store( serialize( user ) ) 5 6
83. Application Warden Warden Manager Proxy Strategy Session 2 1 3 4 5 6 def call(env) ... [ 200, {}, [“Hello #{ user.name }”] ]
84. Application Warden Warden Manager Proxy Strategy Session 2 1 3 4 5 6 def call(env) ... [ 200, {}, [“Hello #{ user.name }”] ] 7
85. Application Warden Warden Manager Proxy Strategy Session Hooks in Warden 2 1 3 4 5 6 [ 200, {}, [“Hello #{ user.name }”] ] 7
86. Application Extra Truth Caps JSON Warden Devise
87. Warden Devise
88. Application Warden
89. Application Warden … … Rack::Session
90. Rails Application … … Warden Rack::Session
91. Simple Rails Auth Configure Rails Middleware Build a Session Serializer Build a Strategy Build session controller Add views for users & session management Add helper methods for current_user and authenticate! more… add gem use generators to install run migrations Warden Devise
92. Devise Warden + Rails + Application • Strategies • Session • Configuration • Initialization • Conventions • Generators • Controllers • Views • Mailers
93. Token Authentication
96. What We Needed • Secure • Individually unique tokens • Easy to generate and revoke
97. Timing Attack CPE1704TKS NUKES4LIFE Count: 0ms
98. Timing Attack CPE1704TKS NUKES4LIFE Count: 1ms
99. Timing Attack CPE1704TKS CPEXXXXXXX Count: 0ms
100. Timing Attack CPE1704TKS CPEXXXXXXX Count: 1ms
101. Timing Attack CPE1704TKS CPEXXXXXXX Count: 2ms
102. Timing Attack CPE1704TKS CPEXXXXXXX Count: 3ms
103. Timing Attack CPE1704TKS CPEXXXXXXX Count: 4ms
104. Constant Time Comparison From Devise
105. What did Devise keep? • Confirmable, Recoverable, etc.. • Secure token generator • Constant-time Compare • Warden
106. What was our solution? • Store only digested tokens • Use constant time compare • Build a Warden Strategy • Bundle the user id & the source token
107. ABC $%Z ABC Random Token Generator Unique Check HMAC Database
108. ABC $%Z ABC Random Token Generator Unique Check HMAC Database
109. ABC Key $%Z ABC Random Token Generator Unique Check HMAC Database
110. ABC Key $%Z ABC Random Token Generator Unique Check HMAC Database
111. ABC Key $%Z ABC Random Token Generator Unique Check HMAC Database
112. ABC Key $%Z ABC Random Token Generator Unique Check HMAC Database
113. ABC Key $%Z ABC Random Token Generator Unique Check HMAC Database
114. ABC Key $%Z ABC Random Token Generator Unique Check HMAC Database
115. ABC Key $%Z ABC ID Random Token Generator Unique Check HMAC Database
116. Key $%Z ABC ID $%Z Constant Time Compare HMAC Database
117. Key $%Z ABC ID $%Z Constant Time Compare HMAC Database
118. Key $%Z ABC ID $%Z Constant Time Compare HMAC Database
119. Key $%Z ABC ID $%Z Constant Time Compare HMAC Database
120. Key $%Z ABC ID $%Z Constant Time Compare HMAC Database
121. Key $%Z ABC ID $%Z Constant Time Compare HMAC Database
122. Key $%Z ABC ID $%Z Constant Time Compare HMAC Database
123. Let’s Build It.
124. Devise Example https://github.com/bobbrez/bostonrb_devise_talk
125. In the future… • Use ActiveSupport::MessageVerifier? • Gem-atize this? • Stay more up to date with libraries
126. Thank You
127. Checkout EverTrue If you’re in the Boston area, we’re always looking for smart people, developers and non-developers alike! ! http://www.evertrue.com/careers http://www.pinterest.com/evertrueco