Giter Site home page Giter Site logo

padrino-warden's Introduction

padrino-warden

A Padrino module that provides authentication for your Padrino application through Warden.

Most of the code was adapted from sinatra_warden.

Gem Version

Usage

Currently padrino-warden uses +password+ as default authentication strategy. If you wish to change that consult Warden.

class SampleApp < Padrino::Application
  register Padrino::Warden

  class User
    attr_reader :name
    def initialize(name)
      @name=name
    end

    def self.authenticate(a, b)
      return User.new('john')
    end
  end

  Warden::Strategies.add(:password) do
    def valid?
      params["email"] || params["password"]
    end

    def authenticate!
      u = User.authenticate(params["email"], params["password"])
      u.nil? ? fail!("Could not log in") : success!(u)
    end
  end

  Warden::Manager.serialize_into_session do |user|
    user.id
  end

  Warden::Manager.serialize_from_session do |id|
    User.get(id)
  end
end

Run this to see your new routes:

$ padrino rake routes

You can now login at http://localhost/sessions/login

After login you can fiddle with current_user for anything you need.

Multi Sub-Apps

padrino-warden can be used across multiple apps in one project. You need to have one UserApp which handles logins and logouts.

Add this to your UserApp(/user):

register Padrino::Warden

This will mount the sessions controller on it:

/user/sessions/...

You OtherApps:

register Padrino::Warden::Helpers

Configure warden globally within config/apps.rb. Don't forget to tell warden about the UserApp:

Padrino.configure_apps do
  ...
  set :warden_failure_app, UserApp
end

Your UserApp needs to be mounted first in Padrino! Cascading routes from the UserApp can cause exceptions, so don't use an app mounted to the root path ('/') as UserApp.

Configuration

There are some options you can override to customize padrino-warden to your needs. Please consult the wiki page to see all of them.

Overriding warden manager defaults

class SampleApp < Padrino::Application
  register Padrino::Warden

  Warden::Strategies.add(:token) do
    def valid?
      params["token"]
    end

    def authenticate!
      ...
    end
  end

  set :warden_config do |manager|
    manager.scope_defaults :api, strategies: [:token], store: false
  end
end

Changelog

Changelog is available on the wiki.

Note on Patches/Pull Requests

  • Fork the project.
  • Make your feature addition or bug fix.
  • Add tests for it. This is important so I don't break it in a future version unintentionally.
  • Commit, do not mess with rakefile, version, or history. (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull)
  • Send me a pull request. Bonus points for topic branches.

Contributors

For sinatra_warden, thanks to: Justin Smestad, Daniel Neighman and Shane Hanna.

Copyright

Copyright (c) 2010 Dotan Nahum (jondot). See LICENSE for details. Copyright (c) 2015 Michał Zając (Quintasan). See LICENSE for details.

padrino-warden's People

Contributors

a-bx avatar argent-smith avatar dodeja avatar elmer avatar feejai avatar graudeejs avatar icco avatar jf avatar jondot avatar jordanlev avatar mariozig avatar meetme2meat avatar quintasan avatar snowyu avatar whitequark avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

padrino-warden's Issues

Full usage example?

Hi. Thank you very much for putting this module together.
I am a total sinatra/padrino n00b (I have some ruby experience, but certainly not a super expert). I'm trying to wrap my head around how to build out my website using warden for authorization/authentication. I understand how to install the gem and put the code into my padrino project. And I understand how to use the authorize! method in my controllers to restrict access to pages. But I'm confused about how I set things up for login workflow. I created a login view and that is successfully being shown when an authorize! check fails. But if I try to log in with an incorrect password, I'm not brought back to the login page itself, but rather to some page I don't have implemented (and I believe it's trying to look for it in a different app within my project -- but I don't understand this because I want to display an error message on the login page itself so the user can try again, not go to some other page in some other section of my website).

Thanks for any help you can provide in how to implement the full workflow for password login and registration.

-Jordan

Can't install gem

I tried using gem install padrino-warden, but won't install. I have github in my sources. No problem installing other gems.

NoMethodError at /sessions/logout

I'm trying to logout via /session/logout. The user actually logout but this error appears:

NoMethodError: undefined method `[]=' for nil:NilClass
gems/rack-flash-0.1.1/lib/rack/flash.rb:62:in `[]='
gems/padrino-warden-0.1.0/lib/padrino/warden.rb:127:in `block (2 levels) in registered'
gems/padrino-core-0.9.14/lib/padrino-core/application/routing.rb:225:in `call'
gems/padrino-core-0.9.14/lib/padrino-core/application/routing.rb:225:in `block in route'
gems/sinatra-1.0/lib/sinatra/base.rb:521:in `instance_eval'
gems/sinatra-1.0/lib/sinatra/base.rb:521:in `route_eval'
gems/padrino-core-0.9.14/lib/padrino-core/application/routing.rb:475:in `block in route!'
gems/padrino-core-0.9.14/lib/padrino-core/application/routing.rb:462:in `catch'
gems/padrino-core-0.9.14/lib/padrino-core/application/routing.rb:462:in `route!'
gems/sinatra-1.0/lib/sinatra/base.rb:601:in `dispatch!'
gems/sinatra-1.0/lib/sinatra/base.rb:411:in `block in call!'
gems/sinatra-1.0/lib/sinatra/base.rb:566:in `instance_eval'
gems/sinatra-1.0/lib/sinatra/base.rb:566:in `block in invoke'
gems/sinatra-1.0/lib/sinatra/base.rb:566:in `catch'
<…>

enable :sessions exists in my app.rb

NameError at /sessions/login

I'm getting this error. I don't know if this is a Padrino issue or a Warden issue, but I just wanted to pass it by you.

NameError at /sessions/login
uninitialized constant Padrino::Warden

Add a ChangeLog

I just upgraded from 0.1.0 to 0.20.1 and noticed the authorize! method is gone?! Please add a ChangeLog for users to read.

Tests

Do you have any plans on testing this gem?

Make all app settings "safe" or else make it clear in the documentation that you should only set them after registration

The current situation right now is some settings are "special" (:auth_login_path, :auth_unauthenticated_path, :auth_logout_path, :default_strategies, :warden_failure_app), and can be safely set before register Padrino::Warden. Other settings have to be set after the register, or else during registration padrino-warden overwrites these settings, even if you've set them to some specific value.

I don't see a point to this arbitrary split, and making people either
(a) remember which settings are where ("safe", or "unsafe"; or "settable before register" vs "settable only after register")
(b) just set everything after the registration (in which case all of those protections (unless app.respond_to?) just seem pointless)
(c) read the source code to find out

I propose either make all of these settings "safe".... or else have them all not be safe, and then make a specific note about this in the documentation. Would appreciate your thoughts on this.

Session cookie not invalidated on logout

I performed the following steps to test this out, using burp suite.

Capture the following requests

  1. successful login through warden (which gives me a session cookie - for example session-cookie-A)
  2. navigate to a page blocked by authorization (session-cookie-A sent along to authorize the request)
  3. log out (which should kill session-cookie-A)

After this logout, I replay request 2, containing session-cookie-A, and I can still see the protected content, and am not redirected to a login page.
I can use this cookie to visit other protected pages as well

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.