Gems You Might Not Need - Authentication and Authorization

Transcript

1. Gems You Might Not Need Authentication and Authorization
2. Authentication Who are you? Authorization Are you allowed to do that?
3. Do I need an authentication gem? Maybe not...
4. has_secure_password • Built in to newer versions of Rails • Adds methods to set and authenticate against a BCrypt password. • This mechanism requires you to have a password_digest attribute. https://gist.github.com/2252946
5. Invitations • Add an invitation_token string attribute to your model • Generate the token with ActiveSupport:: SecureRandom.hex https://gist.github.com/2253047
6. Do I need an authorization gem? Maybe not...
7. Before filters • Methods with redirects https://gist.github.com/2253206
8. Before filters - a step further • Stay flexible to meet needs https://gist.github.com/3f28fd45a9755dfafd72
9. The Forbid pattern • When you need to get more granular than before filters • class ForbiddenError < StandardError • rescue_from ForbiddenError https://gist.github.com/2253303
10. The Forbid pattern - a step further • Stay flexible to meet business needs https://gist.github.com/2253352
11. The End • Simple • Flexible • Easy to understand