Lightweight Authentication in Rails

In previous posts I’ve touched on Devise, a very complete and easy to use authentication system for Rails.  I just noticed another, lighter weight, option.  For those who don’t know, Ryan Bates of Railscasts fame has created his nifty-generators, which make life pretty easy for putting some basic infrastructure in place such as layouts, configuration options, etc.

I hadn’t noticed previously, but Ryan snuck another one into the mix.  The nifty_authentication plug in creates a basic authentication implementation for your rails app.  Here’s how it works.

First, install the nifty_generators gem (let’s live in the now and assume we’re using Rails 3 and bundler) by adding it to your Gemfile and running bundler for the app you’d like to create authentication for.

Add this line to the Gemfile to snag the latest version:

gem 'nifty-generators'

And invoke the sinister powers of bundler…

bundle install

Now, just run Ryan’s magic generator.

rails generate nifty:authentication

With no options, a ‘user’ model is created.  You can easily override that if you’d like to use different names.  When completed, go ahead and run the migration and fire up the server.  Now, if you head over to http://localhost:3000/users/new you’ll be presented with a nice signup form.

Once you create a new user you’ll be logged in.  If you’ve already got an account http://localhost:3000/login will take you to the login page.

That’s pretty much all there is to it!

One Little Glitch

This may be corrected any moment, but there was one problem that I had to deal with.  Specifically, I had to configure the autoload path so the application loads authentication.rb on startup (maybe it’s location moved with Rails 3).  Just add the following line to your config/application.rb file

config.autoload_paths += %W(#{config.root}/lib)

Then you should be all set.

Security

The generator does an MD5 hash of the credentials so you’re not sending out data in cleartext.  This is a pretty common way of doing it.  One thing to think about though is that although the MD5 hash is cryptographically sound, it’s easy to compute.  That means that an automated brute force system could conceivably guess it if the password behind the has is weak.  If you’re excessively paranoid, you may wish to introduce delays (not long enough to annoy your user, but long enough to make brute force attacks unattractive), or apply max attempt limits which lock out the account for a while.

Thanks to Mr. Bates for another cool tool for the toolbox!