Dan, I also was pretty paranoid when I ported to Rails so I know what you are saying, especially since Rails login code is different than other frameworks. Unfortunately, the easy option, HTTP basic auth doesn't work as Rails files are based off controllers. First and foremost, sorry if I explain too much. Disclaimer aside, the best solution would be something like this:
Assumptions:
1. You have a db configured and ready to use (if not, go to your_rails_app/config/database.yml and file out your info)
2. The db has a table called users with id as the primary key, a username field and a password field, a first_name field, and an email field .
3. You have created a symbolic link from your app's public dir to the htdocs dir, or a dir within
To finish configuring the DB, ssh in to your account.
type:
cd /vservers/yourdirectory/your_rails_app
ruby script/generate model user |
Next, in your controller where the user posts comments include the following code at the top, yet right after the controller declaration:
before_filter :check_auth, :except => [:login]
def check_auth
unless session[:user_id]
render :action => :login
end
end
|
Basically, in my code, the var user_id on the srvr referenced by the cookie session id is what determines logins. One thign I like about Rails is that it just sends an id cookie to the user, and every variable you assign is automatically taken care of and stored by rails without the need to make your own system.
Next, let's make the login action. This assumes you have a field named username, and a field named password in the form.
def login
if request.post?
user = params[:username]
pass = params[:password]
login = User.find(:first,
:conditions => [ ' username = ? ' , params[:username]])
# For security's sake, I chose to encrypt the password
if login.blank? || Digest::MD5.hexdigest(pass) != login.password
# Create an error msg
@msg = "Login or password incorrect."
# You can display this message on the view
else
session[:user_id] = login.id
redirect_to_url("Your url for posting")
end
end
end
|
Now, in order to create the place for registration comes the difficult part. Because of the overhead required in protecting random bots or others from registering then posting comments, the best thing would be to have you register those you know, or those that request it. ( of course I could do a Captcha, and various systems, but that starts getting extremely heavy in lines of code and hard to implement). In the posting controller, or whatever the name is, add the following code right below the login def. This assumes you have a username, password, first, and email field on the page
def register
if request.post?
first = params[:first]
email = params[:email]
user = params[:username]
pass = params[:password]
a_user = User.new
a_user.email = email
a_user.first_name = first
a_user.password = Digest::MD5.hexdigest(pass)
a_user.username = user
a_user.save
end
end
|
So that's the auth code. If you have any questions, feel free to pm me.
). Given that so many other things are just about automated in Ruby, is there an easy way to provide at least a simple username / password authentication to access things like posting to the blog (i.e. I don't want any random person on the net stumbling on my test pages and posting garbage or worse). All the examples I've seen involve the installation of gems and I'm not sure I can do that here. What are you guys using to secure your applications?
The other great thing about having it in .pdf form was it was very easy to copy code examples over to my app. without worrying so much about syntax errors that come from retyping everything. </shameless book plug>
