= Authlogic
** Please note the latest version is compatible with rails 3 only. Rails 2 should use version 2.X.X **
Authlogic is a clean, simple, and unobtrusive ruby authentication solution.
A code example can replace a thousand words...
Authlogic introduces a new type of model. You can have as many as you want, and name them whatever you want, just like your other models. In this example, we want to authenticate with the User model, which is inferred by the name:
class UserSession < Authlogic::Session::Base # specify configuration here, such as: # logout_on_timeout true # ...many more options in the documentation end
Log in with any of the following. Create a UserSessionsController and use it just like your other models:
UserSession.create(:login => "bjohnson", :password => "my password", :remember_me => true) session = UserSession.new(:login => "bjohnson", :password => "my password", :remember_me => true); session.save UserSession.create(:openid_identifier => "identifier", :remember_me => true) # requires the authlogic-oid "add on" gem UserSession.create(my_user_object, true) # skip authentication and log the user in directly, the true means "remember me"
The above handles the entire authentication process for you. It first authenticates, then it sets up the proper session values and cookies to persist the session. Just like you would if you rolled your own authentication solution.
You can also log out / destroy the session:
session.destroy
After a session has been created, you can persist it across requests. Thus keeping the user logged in:
session = UserSession.find
To get all of the nice authentication functionality in your model just do this:
class User < ActiveRecord::Base acts_as_authentic do |c| c.my_config_option = my_value end # the configuration block is optional end
This handles validations, etc. It is also "smart" in the sense that it if a login field is present it will use that to authenticate, if not it will look for an email field, etc. This is all configurable, but for 99% of cases that above is all you will need to do.
Also, sessions are automatically maintained. You can switch this on and off with configuration, but the following will automatically log a user in after a successful registration:
User.create(params[:user])
This also updates the session when the user changes his/her password.
Authlogic is very flexible, it has a strong public API and a plethora of hooks to allow you to modify behavior and extend it. Check out the helpful links below to dig deeper.
== Helpful links
Before contacting me directly, please read:
If you find a bug or a problem please post it in the issues section. If you need help with something, please use google groups. I check both regularly and get emails when anything happens, so that is the best place to get help. This also benefits other people in the future with the same questions / problems. Thank you.
== Authlogic "add ons"
If you create one of your own, please let me know about it so I can add it to this list. Or just fork the project, add your link, and send me a pull request.
== Session bugs (please read if you are having issues with logging in / out)
Apparently there is a bug with apache / passenger for v2.1.X with sessions not working properly. This is most likely your problem if you are having trouble logging in / out. This is not an Authlogic issue. This can be solved by updating passener or using an alternative session store solution, such as active record store.
== Documentation explanation
You can find anything you want about Authlogic in the {documentation}[http://rdoc.info/projects/binarylogic/authlogic], all that you need to do is understand the basic design behind it.
That being said, there are 2 models involved during authentication. Your Authlogic model and your ActiveRecord model:
Each of the above has its various sub modules that contain common logic. The sub modules are responsible for including everything related to it: configuration, class methods, instance methods, etc.
For example, if you want to timeout users after a certain period of inactivity, you would look in Authlogic::Session::Timeout. To help you out, I listed the following publicly relevant modules with short descriptions. For the sake of brevity, there are more modules than listed here, the ones not listed are more for internal use, but you can easily read up on them in the {documentation}[http://rdoc.info/projects/binarylogic/authlogic].
=== Authlogic::ActsAsAuthentic sub modules
These modules are for the ActiveRecord side of things, the models that call acts_as_authentic.
=== Authlogic::Session sub modules
These modules are for the models that extend Authlogic::Session::Base.
=== Miscellaneous modules
Miscellaneous modules that shared across the authentication process and are more "utility" modules and classes.
== Quick Rails example
What if creating sessions worked like an ORM library on the surface...
UserSession.create(params[:user_session])
What if your user sessions controller could look just like your other controllers...
class UserSessionsController < ApplicationController def new @user_session = UserSession.new end
def create
@user_session = UserSession.new(params[:user_session])
if @user_session.save
redirect_to account_url
else
render :action => :new
end
end
def destroy
current_user_session.destroy
redirect_to new_user_session_url
end
end
As you can see, this fits nicely into the RESTful development pattern. What about the view...
<% form_for @user_session do |f| %>
<%= f.error_messages %>
<%= f.label :login %>
<%= f.text_field :login %>
<%= f.label :password %>
<%= f.password_field :password %>
<%= f.submit "Login" %>
<% end %>
Or how about persisting the session...
class ApplicationController helper_method :current_user_session, :current_user
private
def current_user_session
return @current_user_session if defined?(@current_user_session)
@current_user_session = UserSession.find
end
def current_user
return @current_user if defined?(@current_user)
@current_user = current_user_session && current_user_session.user
end
end
== Install & Use
Install the gem / plugin (recommended)
Rails 3:
$ sudo gem install authlogic
Rails 2:
$ sudo gem install authlogic --version=2.1.6
Or install as a plugin:
script/plugin install git://github.com/binarylogic/authlogic.git
== Detailed Setup Tutorial
See the {authlogic example}[http://github.com/binarylogic/authlogic_example/tree/master] for a detailed setup tutorial. I did this because not only do you have a tutorial to go by, but you have an example app that uses the same tutorial, so you can play around with with the code. If you have problems you can compare the code to see what you are doing differently.
== Testing
I think one of the best aspects of Authlogic is testing. For one, it cuts out a lot of redundant tests in your applications because Authlogic is already thoroughly tested for you. It doesn't include a bunch of tests into your application, because it comes tested, just like any other library.
For example, think about ActiveRecord. You don't test the internals of ActiveRecord, because the creators of ActiveRecord have already tested the internals for you. It wouldn't make sense for ActiveRecord to copy it's hundreds of tests into your applications. The same concept applies to Authlogic. You only need to test code you write that is specific to your application, just like everything else in your application.
That being said, testing your code that uses Authlogic is easy. Since everyone uses different testing suites, I created a helpful module called Authlogic::TestCase, which is basically a set of tools for testing code using Authlogic. I explain testing Authlogic thoroughly in the {Authlogic::TestCase section of the documentation}[http://rdoc.info/rdoc/binarylogic/authlogic/blob/f2f6988d3b97e11770b00b72a7a9733df69ffa5b/Authlogic/TestCase.html]. It should answer any questions you have in regards to testing Authlogic.
== Tell me quickly how Authlogic works
Interested in how all of this all works? Think about an ActiveRecord model. A database connection must be established before you can use it. In the case of Authlogic, a controller connection must be established before you can use it. It uses that controller connection to modify cookies, the current session, login with HTTP basic, etc. It connects to the controller through a before filter that is automatically set in your controller which lets Authlogic know about the current controller object. Then Authlogic leverages that to do everything, it's a pretty simple design. Nothing crazy going on, Authlogic is just leveraging the tools your framework provides in the controller object.
== What sets Authlogic apart and why I created it
What inspired me to create Authlogic was the messiness of the current authentication solutions. Put simply, they just didn't feel right, because the logic was not organized properly. As you may know, a common misconception with the MVC design pattern is that the model "M" is only for data access logic, which is wrong. A model is a place for domain logic. This is why the RESTful design pattern and the current authentication solutions don't play nice. Authlogic solves this by placing the session maintenance logic into its own domain (aka "model"). Moving session maintenance into its own domain has its benefits:
Copyright (c) 2009 {Ben Johnson of Binary Logic}[http://www.binarylogic.com], released under the MIT license
FAQs
Unknown package
We found that Empact-authlogic demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
AGENTS.md is a fast-growing open format giving AI coding agents a shared, predictable way to understand project setup, style, and workflows.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.