#274 Remember Me & Reset Password

Since rails detects and rejects cookies that have been tampered with, could we just use the user id rather than the auth_token, and put it in a signed cookie? Or, since sessions seem to actually be signed cookies (no?), is there a way in rails to just directly extend the expiration of the session cookie (if there's nothing else we keep in the session that we want to expire sooner)?

Also, about Devise, it's an engine, so changing views or controllers is as simple as putting them directly in your app. With rails engines, what's in your app takes precedence over what's in the engine. If you have no view for X, the it takes it from the engine. If you do, it uses yours. I like the idea of building things from scratch (this is a great episode) and minimizing plugin bloat, but it's worth mentioning.

Once again, nice screencast!

However, I think you have too much logic inside te password_resets_controller. Especially the 2.hours part. Now for small apps this might not be a big problem, but otherwise, I would create something like a PasswordReset class in the model directory to handle this logic for me.

And I agree with @introspectif that Devise is childishly easy to customize. So much so that I would never write my own authentication. There are too many security pitfalls to remember.

I also agree with @Iain and @introspectif that there are too many security loopholes to remember to close each time to build from scratch.

Also I would suggest adding an index on the email column of the user model since every time someone logs in you are performing an

user = User.find_by_email(params[:email])

Ryan,

One problem with your method is that, while the authentication tokens cannot be guessed they can be duplicated and used on another system. It's close to session fixation. I think that the user record should probably store their log-in OS/Browser checksum to validate any returning users.

At least then it would be harder to steal a session.

Awesome episode as usual.

You're right, I prefer using custom logins and authentication over Devise or other methods. I just feel "out of control" when using a plug for something as secure and important as my login.

Keep up the great work!

Nice work. Again for those who didn't understand, this screencast should be consider as an introduction to authentication. The purpose of it is not to define all security hole and patch them.

The Devise source code is very good at this. The engine cover a lot of advance features. I suggest everyone to have a look at it and learn from it.

Secure an application is not an easy task to accomplish. I suggest everyone to create a checklist and verify there projects against it.

For anyone who is still using ruby 1.8.7 for rails 3.0.5
SecureRandom.urlsafe_base64 will generate a method not found error. I used SecureRandom.hex as a substitute and it worked. Just thought I'd share in case this helps anyone...

I like episodes about gems much more: just a little piece of code, and great result. This time i didn't see that. Instead, we got 5 times more code to remember - that's hard for me. :)
Still, there's no need to show everything in things-from-scratch, it's complicated, boring, and will never be the same for other case.
In my opinion, for modern small website we should forget about registering user emails - only omniauth - it's fast, it's handy, but i don't know a simple way to get it up and running on rails yet. For example: devise + omniauth still requires me to know user email. I don't really need it. I'd love to come to website, press "Add comment" button, choose authentication provider, and that's it (just like on railscasts, btw)
Anyways, i'll come back here, to this Episode, whenever i will need authentication from scratch.

Hi, Ryan. Just an observation.

At 5:45 you say something about not letting bad guys know if an email is already registered.

I've heard many people arguing that and many sites implementing it. My experience so far:

• It confuses legitimate users who mistype their email addresses.
• It's useless against bad guys.

Why is it useless? Because on every site I've tried, you can just try to register with a given email address and it gives an error saying "email already registered" if it is.

Ryan,
Nice Podcast as always! You might want to consider doing a podcast on Two factor Authentication since security has been in the media lately and on our minds. https://moocode.com/posts/2-two-factor-authentication-with-rails is a nice tutorial but I think you could make it into a great podcast! Just a though thou. ;0)

Checkout https://github.com/rejeep/authlogic-password-reset-tutorial for reset with Authlogic!

Great episode. And I too want to put my vote down for more "from scratch" episodes.

I love the gem community and all the Github repos out there, and while I sometimes use these screencasts to find new "gems" amongst the gems, I mainly use it to learn and follow along while I write the same code, in my own style.

Thanks again!

Fantastic episode, Ryan. I am an experienced developer but a newbie to Rails. I enjoyed this "from scratch" episode immensely.

Do you any episodes where you go without scaffolding? Any where you plug in the different parts like controller, model(is this always necessary), view, custom validation, helpers by hand and as late as possible?

I see many blog posts about how scaffolding is not the recommended way but haven't found much guidance on how to do this from scratch.

Also, I am also very interested in BDD (behaviour driven development) and am hoping you can give some guidance on how to do that.

Thanks for your contribution
-Venu

Hey Ryan. If we're in the topic of authentication - is there any chance You could make an episode about creating oAuth provider?

There's no good tutorial out there about this.

Great episode btw! :)

One more great article. But I prefer using authlogic or device to achieve those results as those gems have a lot of features explained here and much more. And they're covered with tests what is important!

I am new also to rails. Is there a way to generate a unique token with a key (like the user id), which would ensure its uniqueness, which would prevent you from having to check if it already exist in the user table.

Thanks a lot Ryan,
Your approach does not allow a user to remember me from multiple machines. So I guess it worth to mention that. Also it worth to mention that probably storing the tokens in a Rails.cache is more scalable and durability can be achieved if the cache is backed by a durable cache (like membase)

has anyone encountered this error going through this tut!!

undefined method `urlsafe_base64' for SecureRandom:Module

app/models/user.rb:39:in generate_token'
app/models/user.rb:31:insend_password_reset'
app/controllers/password_resets_controller.rb:7:in `create'

because I have and i've no idea how to solve this..

Ryan make a wonderful new Screencast! I instantly implemented this within my project.
For a rake-task (to reset auth_token)Ryan recommandedin the video I personally wrote:

namespace :user do
  desc "Rebuild Auth-Tokens"
  task :rebuild_auth_token => :environment do
    User.transaction do
      User.all.each { |u|
        u.generate_token(:auth_token)
        u.save!
      }
    end
  end
end

Hey Ryan!

I'm new to Rails and I really like Your screencasts.
However, I think I've found kind of security flaw in this one.

In password_resets_controller.rb you do:

@user.update_attributes(params[:user])

It allows the user to change any attribute he wants using prepared form/request.

I realize this is just an example, and in production you probably wouldn't do it, but still, it's not good example IMHO.

Correct me if I'm wrong.

You could use UrlStore https://github.com/grosser/url_store and just encode user id and expiration time inside the url, no new columns needed. Only drawback is that the token gets longer.

code = UrlStore.encode([user.id, 2.hours.from_now])
...
if id, expires = UrlStore.decode(params[:id])
  if expires > Time.zone.now
    ...

Bye bye Authlogic/Devise, hello Ryan's "authentication from scratch" + CanCan. Thank you.

@Iain

"Devise is childishly easy to customize".

That's only true for simple, small applications.

"There are too many security pitfalls to remember"

And that's true for Devise customizations in more complex scenarios ;)

For some reason cookies.delete[:auth_token] does not work in Rails 3.1.
I had to use cookies.delete :auth_token to get it to destroy the session.

Great screencast! I realy love your "*from scratch" screencasts but i encountered some problems:
I had to use save!(validate: false) in the send_password_reset method after i added some validation on my user model. Why does the validation for the presence of a password and password_confirmation fire on the reset password form? And is there any way to validate only for a valid email withou using javascript?

Hello, i retrieve an error by submit "reset the Password":

LoadError in PasswordResetsController#create

app/models/user.rb:13:in 'send_password_reset'
app/controllers/password_resets_controller.rb:7:in 'create'

Have anybody a Idea? Thanks!

I keep getting

Couldn't find User with auth_token = ):

in my template I use:

<% if current_user %>
                      Logged in as <%= current_user.email %>.
                      <% end %>

in my application.rb it is defines

def current_user
    @current_user ||= User.find_by_auth_token!(cookies[:auth_token]) if cookies[:auth_token] 
  end

happens when a user is trying to reset the password.

I think it's important to mention that when you set @current_user with cookie instead of session you lose the efficiency of rails CSRF protection.

It's happen because when rails protect_from_forgery method identify CSRF attack it's reset only the session and not the user's cookies.

To fix it you need to override handle_unverified_request()
at MODULE ActionController::RequestForgeryProtection::ClassMethods
and define it to delete auth_token cookie

Hey...Anyone else having problems with validations?
Ny solutions?

for anybody having the same problem with testing, when switching from session to cookies. You need to use request.cookies to assign the cookie.

RSpec.configure do |config|
  def test_sign_in(user)
    request.cookies[:auth_token] = @user.auth_token
  end
end

and in your normal specs where you use test_sign_in

request.cookies[:auth_token].should == @user.auth_token

in specs where you dont use test_sign_in but rather post :create, :email => "user@example.com", :password => "somepassword"

cookies[:auth_token].should == @user.auth_token

its really confusing me

@ryan is there any reason why in the PasswordResetsController you perform the 2 hour check in the update action and not in the edit action? It seems counter-intuitive to have the user post a new password, and then inform them that the password reset token has expired. Is there any reason why you wouldn't do it like this?

class PasswordResetsController < ApplicationController
  
  def new
  end
  
  def create
    user = User.find_by_email(params[:email])
    user.send_password_reset if user
    redirect_to root_url, :notice => "Password reset instructions sent by email."
  end
  
  def edit
    @user = User.find_by_password_reset_token!(params[:id])
    if @user.password_reset_sent_at < 2.hours.ago
      redirect_to new_password_reset_path, :alert => "Password reset has expired, please request another reset."
    end
  end
  
  def update
    @user = User.find_by_password_reset_token!(params[:id])
    if @user.update_attributes(params[:user])
      redirect_to root_url, :notice => "Password has been reset."
    else
      render :edit
    end
  end
  
end

And thanks for showing us this, I've now ditched Devise and feel cleansed.

I love this solution but as a total rails noob, I don't know how to test for it, it would be great to have some explanation or, even better, an episode on it.

Regarding validations...

Well, if you're like me, you have password validation and also encrypt the password before saving the user model.

That's a big monkey wrench for Ryan's excellent solution above.

To get it all to work, I created a PasswordReset model