Giter Club home page Giter Club logo

rails_warden's Introduction

Rails Warden

Build Status

This application adds some nice helpers on-top of the base Warden Rack layer. It aims to make Warden easier to use in Rails-based environments without something as heavy-weight as devise.

Installation

Add this line to your application's Gemfile:

gem 'rails_warden'

And then execute

$ bundle

Or install it yourself as:

$ gem install rails_warden

Usage

Create a new Rails initializer to inject RailsWarden into the Rails middleware stack:

# config/initializers/warden.rb
Rails.configuration.middleware.use RailsWarden::Manager do |manager|
  manager.failure_app = Proc.new { |_env|
    ['401', {'Content-Type' => 'application/json'}, { error: 'Unauthorized', code: 401 }]
  }
  manager.default_strategies :password # needs to be defined
  # Optional Settings (see Warden wiki)
  # manager.scope_defaults :admin, strategies: [:password]
  # manager.default_scope = :admin # optional default scope
  # manager.intercept_401 = false # Warden will intercept 401 responses, which can cause conflicts
end

If you want to customize the Session serializer (optional), add the following to the intializer:

class Warden::SessionSerializer
  def serialize(record)
    [record.class.name, record.id]
  end

  def deserialize(keys)
    klass, id = keys
    klass.find_by(id: id)
  end
end

The next step is to configure warden with some authentication strategies. Check out the warden wiki for that.

Application Mixin

RailsWarden ships with a helpful set of methods and helpers for use inside of ActionController.

To use them, just include them inside your base controller.

class ApplicationController < ActionController::Base
  include RailsWarden::Authentication
end

rails_warden's People

Contributors

chubchenko avatar fnordfish avatar grosser avatar hp avatar iamchrismiller avatar jsmestad avatar jspooner avatar madmike avatar olleolleolle avatar qhoxie avatar raven24 avatar roman avatar sam-wan avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

rails_warden's Issues

Slow access to cookies

The first access to cookies is costing ~400-500ms for me right now when using Rails 3.1. The problem first started occurring when I upgraded rails. The instantiation of the controller controller.new(self.request, self.response).send(:cookies) on line 44 of rails_warden.rb seems to be the issue. Rewriting the function to

def cookies
  self.request.cookie_jar
end

resolves the issue for me, but may not be sufficiently robust. Happy to submit a pull request with that change but I suspect you'll have a better way of fixing it. Let me know if I can be of any assistance in resolving this.

RailsWarden holds on to references of the entire middleware stack infinitely

Due to the fact that

  Warden::Manager.before_failure do |env, opts|
    if request = env["action_controller.rescue.request"]
      request.params["action"] = RailsWarden.unauthenticated_action
    end
  end

is in RailsWarden::Manager.new, whose scope includes the passed-in app, when Warden::Manager stores the block given to it, the object references in the enclosing scope are also stored. Thus, any middleware objects are kept around forever, and the memory footprint of the app grows indefinitely with each request.

This issue would be fixed by a proper fix to http://github.com/hassox/rails_warden/issues#issue/2, such that the block is not added to Warden::Manager.before_failure each time.

Why pop out an login alert dialog instead of redirecting to the login page?

I have set up all things that the Devise needs. And things works fine for me.
But there is one thing very annoying:
When I request the pages which need authentication through the browser(Firefox).It just pop out an alert dialog says:

"A username and password are being requested by http://localhost:3001. The site says: "Application"'
with the user name and password input fields instead of redirecting to the login page (the "/users/sign_in" page).But even, whatever user name and password I typed in, I just can't access (I can successfully login through the "/users/sign_in" with the same info).

manager.failure_app and InvalidAuthenticityToken

Hi team,

First of all, I know this falls more on the Rails side than on the Warden side, but since it's such a common setup, I thought it's ok to go ahead and ask.

Most of the tutorials out there that talk about Warden + Rails (e.g. Railscasts #305, Warden's own wiki) suggest the following failure_app config:

manager.failure_app = lambda { |env| SessionsController.action(:new).call(env) }

However this seems to cause an InvalidAuthenticityToken if the strategy fails. As far as I can tell, this is because:

  1. First we POST the login form, w/ CSRF token
  2. The request reaches Sessions#create, CSRF token is validated and cycled.
  3. Warden is called, performs the check, if it passes high fives, otherwise :failure_app
  4. When :failure_app is configured as above, the request is then handed to the :new action in SessionsController but the entire request environment is passed along.
  5. Rails' CSRF protection filter reviews the request headers before running :new and because in the original request (point #1 above) we sent a POST bails, saying we're POST'ing w/o a valid CSRF token (invalidated at #2 above).

Some posters suggest to skip the CSRF filter in SessionsController#new, which I trust would work, but the truth is that the CSRF filter shouldn't even kick in, because SessionsController#new is typically a GET request.

If I alter my Warden manager's :failure_app setup to:

  manager.failure_app = lambda do |env|
    env['REQUEST_METHOD'] = 'GET'
    SessionsController.action(:new).call(env)
  end

The CSRF filter doesn't complain.

Does this make sense? Am I understanding the inner workings correctly, and addressing the underlying problem?

Many thanks!

Setting `unauthenticated_action` with Rails config block

Seems that we do not have any example of how to set unauthenticated_action on RailsWarden

Example I expected to work:

Rails.configuration.middleware.use RailsWarden::Manager do |manager|
  manager.default_strategies :bcrypt
  manager.failure_app = SessionsController
  manager.unauthenticated_action = :failure
end

But that returns an undefined error:

config/initializers/warden.rb:4:in `block in <top (required)>': undefined method `unauthenticated_action=' for #<Warden::Config:0x007fe0ae0a8d68> (NoMethodError)
        from /Users/justin/.rbenv/versions/1.9.3-p125/lib/ruby/gems/1.9.1/gems/warden-1.2.0/lib/warden/manager.rb:23:in `initialize'
        from /Users/justin/.rbenv/versions/1.9.3-p125/lib/ruby/gems/1.9.1/gems/rails_warden-0.5.7/lib/rails_warden/manager.rb:20:in `new'
        from /Users/justin/.rbenv/versions/1.9.3-p125/lib/ruby/gems/1.9.1/gems/rails_warden-0.5.7/lib/rails_warden/manager.rb:20:in `new'
        from /Users/justin/.rbenv/versions/1.9.3-p125/lib/ruby/gems/1.9.1/gems/actionpack-3.2.5/lib/action_dispatch/middleware/stack.rb:43:in `build'
        from /Users/justin/.rbenv/versions/1.9.3-p125/lib/ruby/gems/1.9.1/gems/actionpack-3.2.5/lib/action_dispatch/middleware/stack.rb:113:in `block in build'
        from /Users/justin/.rbenv/versions/1.9.3-p125/lib/ruby/gems/1.9.1/gems/actionpack-3.2.5/lib/action_dispatch/middleware/stack.rb:113:in `each'
        from /Users/justin/.rbenv/versions/1.9.3-p125/lib/ruby/gems/1.9.1/gems/actionpack-3.2.5/lib/action_dispatch/middleware/stack.rb:113:in `inject'
        from /Users/justin/.rbenv/versions/1.9.3-p125/lib/ruby/gems/1.9.1/gems/actionpack-3.2.5/lib/action_dispatch/middleware/stack.rb:113:in `build'
        from /Users/justin/.rbenv/versions/1.9.3-p125/lib/ruby/gems/1.9.1/gems/railties-3.2.5/lib/rails/engine.rb:470:in `app'
...

Bump version for changes in may 2011

Could you please bump the version (to e.g. 0.5.6) so the changes in may 2011 are available in the gem?
I need this for a Rails 3.1 engine which I package as gem and IMHO I can't refer to a GIT path the gemspec.

Thanks!

README config example

In lib/rails_warden.rb you have

class Warden::SessionSerializer
  def serialize(user)
    [user.class.name, user.id]
  end
  ...

But in the README it looks like you are serializing 'record.class'--the object, not the name.

block in <class:Railtie>': wrong number of arguments (1 for 0)

I'm trying to use rails_warden in rails 3.1 engine. When I'm try start server, I',m got these error:
vk@vk-desktop:~/work/aspo/aspo_core/auth$ r s
=> Booting WEBrick
=> Rails 3.1.0.rc5 application starting in development on http://0.0.0.0:3000
=> Call with -d to detach
=> Ctrl-C to shutdown server
Exiting
/home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/rails_warden-0.5.5/lib/rails_warden.rb:90:in block in <class:Railtie>': wrong number of arguments (1 for 0) (ArgumentError) from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/initializable.rb:25:ininstance_exec'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/initializable.rb:25:in run' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/initializable.rb:50:inblock in run_initializers'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/initializable.rb:49:in each' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/initializable.rb:49:inrun_initializers'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/application.rb:92:in initialize!' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/railtie/configurable.rb:30:inmethod_missing'
from /home/vk/work/aspo/aspo_core/auth/spec/dummy/config/environment.rb:5:in <top (required)>' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/activesupport-3.1.0.rc5/lib/active_support/dependencies.rb:237:inrequire'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/activesupport-3.1.0.rc5/lib/active_support/dependencies.rb:237:in block in require' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/activesupport-3.1.0.rc5/lib/active_support/dependencies.rb:223:inblock in load_dependency'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/activesupport-3.1.0.rc5/lib/active_support/dependencies.rb:639:in new_constants_in' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/activesupport-3.1.0.rc5/lib/active_support/dependencies.rb:223:inload_dependency'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/activesupport-3.1.0.rc5/lib/active_support/dependencies.rb:237:in require' from /home/vk/work/aspo/aspo_core/auth/spec/dummy/config.ru:4:inblock in

'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/rack-1.3.2/lib/rack/builder.rb:51:in instance_eval' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/rack-1.3.2/lib/rack/builder.rb:51:ininitialize'
from /home/vk/work/aspo/aspo_core/auth/spec/dummy/config.ru:1:in new' from /home/vk/work/aspo/aspo_core/auth/spec/dummy/config.ru:1:in'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/rack-1.3.2/lib/rack/builder.rb:40:in eval' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/rack-1.3.2/lib/rack/builder.rb:40:inparse_file'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/rack-1.3.2/lib/rack/server.rb:200:in app' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/commands/server.rb:46:inapp'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/rack-1.3.2/lib/rack/server.rb:301:in wrapped_app' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/rack-1.3.2/lib/rack/server.rb:252:instart'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/commands/server.rb:70:in start' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/commands.rb:54:inblock in <top (required)>'
from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/commands.rb:49:in tap' from /home/vk/.rvm/gems/ruby-1.9.2-p180@aspo/gems/railties-3.1.0.rc5/lib/rails/commands.rb:49:in<top (required)>'
from /home/vk/work/aspo/aspo_core/auth/spec/dummy/script/rails:6:in require' from /home/vk/work/aspo/aspo_core/auth/spec/dummy/script/rails:6:in<top (required)>'
from /home/vk/tools/fake_gem/lib/fake_gem.rb:44:in load' from /home/vk/tools/fake_gem/lib/fake_gem.rb:44:inload'
from script/rails:6:in `'

vk@vk-desktop:~/work/aspo/aspo_core/auth$ ruby -v
ruby 1.9.2p180 (2011-02-18 revision 30909) [i686-linux]

vk@vk-desktop:~/work/aspo/aspo_core/auth$ rails -v
Rails 3.1.0.rc5

RailsWarden::Manager adds a before_failure callback to Warden::Manager for each request

Because of the way Rails's middleware builder is implemented, RailsWarden::Manager.new gets called for each request. Because this method calls Warden::Manager.before_failure, which stores the passed-in block as a class instance variable, Warden::Manager._before_failure.size grows by 1 for each request.

RailsWarden should register the "action_controller.rescue.request" with Warden only once.

please release

@hassox

you can also give me rubygems access ([email protected]) and I'll take care of it (we are running a few pretty big projects on it and are refactoring our auth stack right now)

Warden helpers becomes undefined when used with cucumber and rspec-rails

I am not sure that this is exactly warden issue (sorry for rhyming), but users should know about this problem so I opening this one.
I am using cucumber + rspec-rails and by default I have the following in cucumber environment:

config.gem "rspec-rails", :lib => "spec/rails", :version => ">= 1.2.7"

That can result in:
undefined local variable or method `warden' for #ActionView::Base:0x24de7f0 (ActionView::TemplateError)

All works fine if gem config changed to:

config.gem "rspec-rails", :lib => false, :version => ">= 1.2.7"

Warden inspect output is huge and it slows down Rails exception pages on development

The exception backtrace page that's rendered for exceptions on development includes an env dump section that shows all the env keys including an inspect of the warden object. This content is huge (several MB) and causes the page to take a long time to render.
Here is a related Rails issue:
https://rails.lighthouseapp.com/projects/8994/tickets/5027-_request_and_responseerb-and-diagnosticserb-take-an-increasingly-long-time-to-render-in-development-with-multiple-show-tables-calls

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.