#274 Remember Me & Reset Password

Since rails detects and rejects cookies that have been tampered with, could we just use the user id rather than the auth_token, and put it in a signed cookie? Or, since sessions seem to actually be signed cookies (no?), is there a way in rails to just directly extend the expiration of the session cookie (if there's nothing else we keep in the session that we want to expire sooner)?

Also, about Devise, it's an engine, so changing views or controllers is as simple as putting them directly in your app. With rails engines, what's in your app takes precedence over what's in the engine. If you have no view for X, the it takes it from the engine. If you do, it uses yours. I like the idea of building things from scratch (this is a great episode) and minimizing plugin bloat, but it's worth mentioning.

Once again, nice screencast!

However, I think you have too much logic inside te password_resets_controller. Especially the 2.hours part. Now for small apps this might not be a big problem, but otherwise, I would create something like a PasswordReset class in the model directory to handle this logic for me.

And I agree with @introspectif that Devise is childishly easy to customize. So much so that I would never write my own authentication. There are too many security pitfalls to remember.

I also agree with @Iain and @introspectif that there are too many security loopholes to remember to close each time to build from scratch.

Also I would suggest adding an index on the email column of the user model since every time someone logs in you are performing an

user = User.find_by_email(params[:email])

Ryan,

One problem with your method is that, while the authentication tokens cannot be guessed they can be duplicated and used on another system. It's close to session fixation. I think that the user record should probably store their log-in OS/Browser checksum to validate any returning users.

At least then it would be harder to steal a session.

Awesome episode as usual.

You're right, I prefer using custom logins and authentication over Devise or other methods. I just feel "out of control" when using a plug for something as secure and important as my login.

Keep up the great work!

Nice work. Again for those who didn't understand, this screencast should be consider as an introduction to authentication. The purpose of it is not to define all security hole and patch them.

The Devise source code is very good at this. The engine cover a lot of advance features. I suggest everyone to have a look at it and learn from it.

Secure an application is not an easy task to accomplish. I suggest everyone to create a checklist and verify there projects against it.

For anyone who is still using ruby 1.8.7 for rails 3.0.5
SecureRandom.urlsafe_base64 will generate a method not found error. I used SecureRandom.hex as a substitute and it worked. Just thought I'd share in case this helps anyone...

I like episodes about gems much more: just a little piece of code, and great result. This time i didn't see that. Instead, we got 5 times more code to remember - that's hard for me. :)
Still, there's no need to show everything in things-from-scratch, it's complicated, boring, and will never be the same for other case.
In my opinion, for modern small website we should forget about registering user emails - only omniauth - it's fast, it's handy, but i don't know a simple way to get it up and running on rails yet. For example: devise + omniauth still requires me to know user email. I don't really need it. I'd love to come to website, press "Add comment" button, choose authentication provider, and that's it (just like on railscasts, btw)
Anyways, i'll come back here, to this Episode, whenever i will need authentication from scratch.

Hi, Ryan. Just an observation.

At 5:45 you say something about not letting bad guys know if an email is already registered.

I've heard many people arguing that and many sites implementing it. My experience so far:

• It confuses legitimate users who mistype their email addresses.
• It's useless against bad guys.

Why is it useless? Because on every site I've tried, you can just try to register with a given email address and it gives an error saying "email already registered" if it is.

Ryan,
Nice Podcast as always! You might want to consider doing a podcast on Two factor Authentication since security has been in the media lately and on our minds. https://moocode.com/posts/2-two-factor-authentication-with-rails is a nice tutorial but I think you could make it into a great podcast! Just a though thou. ;0)

Checkout https://github.com/rejeep/authlogic-password-reset-tutorial for reset with Authlogic!

Great episode. And I too want to put my vote down for more "from scratch" episodes.

I love the gem community and all the Github repos out there, and while I sometimes use these screencasts to find new "gems" amongst the gems, I mainly use it to learn and follow along while I write the same code, in my own style.

Thanks again!

Fantastic episode, Ryan. I am an experienced developer but a newbie to Rails. I enjoyed this "from scratch" episode immensely.

Do you any episodes where you go without scaffolding? Any where you plug in the different parts like controller, model(is this always necessary), view, custom validation, helpers by hand and as late as possible?

I see many blog posts about how scaffolding is not the recommended way but haven't found much guidance on how to do this from scratch.

Also, I am also very interested in BDD (behaviour driven development) and am hoping you can give some guidance on how to do that.

Thanks for your contribution
-Venu

Hey Ryan. If we're in the topic of authentication - is there any chance You could make an episode about creating oAuth provider?

There's no good tutorial out there about this.

Great episode btw! :)

One more great article. But I prefer using authlogic or device to achieve those results as those gems have a lot of features explained here and much more. And they're covered with tests what is important!

I am new also to rails. Is there a way to generate a unique token with a key (like the user id), which would ensure its uniqueness, which would prevent you from having to check if it already exist in the user table.

Thanks a lot Ryan,
Your approach does not allow a user to remember me from multiple machines. So I guess it worth to mention that. Also it worth to mention that probably storing the tokens in a Rails.cache is more scalable and durability can be achieved if the cache is backed by a durable cache (like membase)

has anyone encountered this error going through this tut!!

undefined method `urlsafe_base64' for SecureRandom:Module

app/models/user.rb:39:in generate_token'
app/models/user.rb:31:insend_password_reset'
app/controllers/password_resets_controller.rb:7:in `create'

because I have and i've no idea how to solve this..

Ryan make a wonderful new Screencast! I instantly implemented this within my project.
For a rake-task (to reset auth_token)Ryan recommandedin the video I personally wrote:

namespace :user do
  desc "Rebuild Auth-Tokens"
  task :rebuild_auth_token => :environment do
    User.transaction do
      User.all.each { |u|
        u.generate_token(:auth_token)
        u.save!
      }
    end
  end
end

Hey Ryan!

I'm new to Rails and I really like Your screencasts.
However, I think I've found kind of security flaw in this one.

In password_resets_controller.rb you do:

@user.update_attributes(params[:user])

It allows the user to change any attribute he wants using prepared form/request.

I realize this is just an example, and in production you probably wouldn't do it, but still, it's not good example IMHO.

Correct me if I'm wrong.

You could use UrlStore https://github.com/grosser/url_store and just encode user id and expiration time inside the url, no new columns needed. Only drawback is that the token gets longer.

code = UrlStore.encode([user.id, 2.hours.from_now])
...
if id, expires = UrlStore.decode(params[:id])
  if expires > Time.zone.now
    ...

Bye bye Authlogic/Devise, hello Ryan's "authentication from scratch" + CanCan. Thank you.

@Iain

"Devise is childishly easy to customize".

That's only true for simple, small applications.

"There are too many security pitfalls to remember"

And that's true for Devise customizations in more complex scenarios ;)

For some reason cookies.delete[:auth_token] does not work in Rails 3.1.
I had to use cookies.delete :auth_token to get it to destroy the session.

Great screencast! I realy love your "*from scratch" screencasts but i encountered some problems:
I had to use save!(validate: false) in the send_password_reset method after i added some validation on my user model. Why does the validation for the presence of a password and password_confirmation fire on the reset password form? And is there any way to validate only for a valid email withou using javascript?

Hello, i retrieve an error by submit "reset the Password":

LoadError in PasswordResetsController#create

app/models/user.rb:13:in 'send_password_reset'
app/controllers/password_resets_controller.rb:7:in 'create'

Have anybody a Idea? Thanks!

I keep getting

Couldn't find User with auth_token = ):

in my template I use:

<% if current_user %>
                      Logged in as <%= current_user.email %>.
                      <% end %>

in my application.rb it is defines

def current_user
    @current_user ||= User.find_by_auth_token!(cookies[:auth_token]) if cookies[:auth_token] 
  end

happens when a user is trying to reset the password.

I think it's important to mention that when you set @current_user with cookie instead of session you lose the efficiency of rails CSRF protection.

It's happen because when rails protect_from_forgery method identify CSRF attack it's reset only the session and not the user's cookies.

To fix it you need to override handle_unverified_request()
at MODULE ActionController::RequestForgeryProtection::ClassMethods
and define it to delete auth_token cookie

Hey...Anyone else having problems with validations?
Ny solutions?

for anybody having the same problem with testing, when switching from session to cookies. You need to use request.cookies to assign the cookie.

RSpec.configure do |config|
  def test_sign_in(user)
    request.cookies[:auth_token] = @user.auth_token
  end
end

and in your normal specs where you use test_sign_in

request.cookies[:auth_token].should == @user.auth_token

in specs where you dont use test_sign_in but rather post :create, :email => "user@example.com", :password => "somepassword"

cookies[:auth_token].should == @user.auth_token

its really confusing me

@ryan is there any reason why in the PasswordResetsController you perform the 2 hour check in the update action and not in the edit action? It seems counter-intuitive to have the user post a new password, and then inform them that the password reset token has expired. Is there any reason why you wouldn't do it like this?

class PasswordResetsController < ApplicationController
  
  def new
  end
  
  def create
    user = User.find_by_email(params[:email])
    user.send_password_reset if user
    redirect_to root_url, :notice => "Password reset instructions sent by email."
  end
  
  def edit
    @user = User.find_by_password_reset_token!(params[:id])
    if @user.password_reset_sent_at < 2.hours.ago
      redirect_to new_password_reset_path, :alert => "Password reset has expired, please request another reset."
    end
  end
  
  def update
    @user = User.find_by_password_reset_token!(params[:id])
    if @user.update_attributes(params[:user])
      redirect_to root_url, :notice => "Password has been reset."
    else
      render :edit
    end
  end
  
end

And thanks for showing us this, I've now ditched Devise and feel cleansed.

I love this solution but as a total rails noob, I don't know how to test for it, it would be great to have some explanation or, even better, an episode on it.

Regarding validations...

Well, if you're like me, you have password validation and also encrypt the password before saving the user model.

That's a big monkey wrench for Ryan's excellent solution above.

To get it all to work, I created a PasswordReset model (the only way I know of to avoid the before save calls on the user model). I used almost all of Ryan's code but had to make a few modifications.

Then, I had to modify the password_resets controller to make use of the new model. I also moved the 2.hours_ago check to the edit action because it improves the user experience (oh, and I also plan on running a weekly job to remove old password reset tokens)

All-in-all it works pretty well (in need of some refactoring, though because I think the controller is too fat...) Here's the code - I hope it helps!

''' ruby

class PasswordResetsController < ApplicationController
def new
end

def create
user = User.find_by_email(params[:email])
if user
user.create_password_reset
UserMailer.delay.password_reset(user)
end
redirect_to root_url, :notice => "Email sent with password reset instructions."
end

def edit
password_reset = PasswordReset.find_by_password_reset_token(params[:id])
if password_reset.nil?
redirect_to root_path
return
else

@user = password_reset.user
if password_reset.created_at < 2.hours.ago
flash[:notice] = "Password reset has expired. Please try again"
redirect_to new_password_reset_path
end
end
end

def update
@user = PasswordReset.find_by_password_reset_token!(params[:id]).user
if @user.update_attributes(params[:user])
redirect_to root_path, :notice => "Password has been reset!"
else
render :edit
end
end
end
'''

I am learning Rails by myself and your tutorials have been extremely helpful!

I am coming across an issue with the remember me. Regardless of if I click on the "remember me" or not, the site still remembers me after I close and reopen a new browser. Is anyone else having that same issue?

Thanks.

The :auth_token is "text plain" accessible in the cookie (since signing it would not help), capturing it would give access (a valid current_user) to any one who knows how to inject it later, no need to a password-based authorization process... wouldn't be wise to generate a new :auth_token for the current_user and save it before SessionsController#destroy?

(e.g.: you can inspect the cookie once and then later in any javascript console -> document.cookie("auth_token=7h3$u53r&H45H"); )

-> Kind of have no time to read all the comments, sorry if the subject have already been discussed.

@dicky - It sounds like the cookie is always being set as permanent. So, I'd check the 'if' statement that sets the cookie to and make sure it's actually doing what you'd like it to do. I'm sure if you post the code (here, or for example, on RailsForum,) someone will help you out.

I was getting an error and the emails weren't being sent when I was submitting the form after filling in my email address. I had to make a change to this code below:


def password_reset(user)
@user = user
mail :to => user.email, :subject => "Password Reset"
end


I had to change

user.email

to

@user.email


I'm guessing this is a little bug, but why would you want the reset_token to be considered expired if it is less than 2 hours old? shouldn't it be if it is more than 2 hours old??

Thanks for this great screencast. I have just implemented this into an application with omniauth identity.. However it seems

elsif @identity.update_attributes(params[:identity])

does not seem to change the password as it would if I were using roll-your-own authentication.

Where am I going wrong. I am still quite new to rails so any suggestions would be a big help

Thanks!

Has anybody gotten this to work with 1.9.3? There is the missing "authenticate" method error only with 1.9.3, and not with 1.9.2. I verified this by using the same app on both rubies.

On Chrome 14.0 and Firefox I am using on Ubuntu, cookies are generated even if I am not checking remember me. I see _auth_session and auth_token in the cookies browser. Both are set to expire when browser is closed. But after I closed the browser and reopened it, I am automatically signed in. Only way to sign out is to click logout.

Does anyone know what could be going on? I am using the original code.

Another great screencast.

I've implemented this auth_token into an app that uses simple omniauth (#241) for authentication. Is this auth_token the same token I could use for a user to call my app's API or do I need to generate a different token for that purpose?

I don't know if anyone else ran into this problem but I had to put

def destroy
    #does stuff
    cookies.delete(:auth_token)
    #does stuff
  end

otherwise it would blow up when redirected back to the homepage after deleting a user account.

Definitely should set password_reset_token to nil after successful password reset to prevent reusing the link, especially for long expiration time.

The fields for the password_resets edit form are not validating for me. Has anyone else had this problem?

Nice episode, but I would recommend to set Http-only setting for auth-cookies so if site somehow have xss hole attacker cannot steal cookies through javascript.

Is there any good way to expose this authentication scheme to http requests? (or JSON)... I'm trying to write exposed apis for an iOS application that needs to talk to a rails app that I used this autentication scheme in.

Very useful episode.

Very useful, thanks, Ryan!!!

Real life example of similar auth you can find at http://gistflow.com (open source).

Famous Egor Homyakov hacked us using bug described here:

http://gistflow.com/posts/174

The thing is that if you store auth_token in cookies csrf protection will not work.

Good luck everyone with safe auth :)

As usual, a really useful and clear episode, thank you Ryan.

Just a couple of minor points. In the ASCIIcast, there is unrendered '↵' (in the config/environments/development.rb section).

Also, for people who have never used the mailer before (like me), it might be worth pointing out there is further configuration to get the Mailer fully working, as outlined in your Action Mailer railscast.

Thank you Ryan, very interesting episode!
I'm trying to get the mailer to work on heroku. I did
heroku addons:add sendgrid:starter
but whenever I try to send an email from heroku, I get this error:

2012-07-18T23:14:05+00:00 heroku[router]: GET guestlist12.herokuapp.com/assets/application-ea8b32131f736b7d8bc98f7cb199c9cf.css dyno=web.1 queue=0 wait=0ms service=11ms status=304 bytes=0
2012-07-18T23:14:10+00:00 app[web.1]: 
2012-07-18T23:14:10+00:00 app[web.1]: 
2012-07-18T23:14:10+00:00 app[web.1]: Started POST "/password_resets" for 68.5.179.249 at 2012-07-18 23:14:10 +0000
2012-07-18T23:14:10+00:00 app[web.1]: Processing by PasswordResetsController#create as HTML
2012-07-18T23:14:10+00:00 app[web.1]:   Parameters: {"utf8"=>"✓", "authenticity_token"=>"H1VHMVJocUWdwzwVV0AbLB1Pfqgug+jT846sE794ISA=", "email"=>"cedric.waldburger@mediasign.ch", "commit"=>"Reset Password"}
2012-07-18T23:14:10+00:00 app[web.1]:   Rendered user_mailer/password_reset.text.erb (0.8ms)
2012-07-18T23:14:13+00:00 app[web.1]: Sent mail to cedric.waldburger@mediasign.ch (3117ms)
2012-07-18T23:14:13+00:00 app[web.1]: Completed 500 Internal Server Error in 3410ms
2012-07-18T23:14:13+00:00 app[web.1]: 
2012-07-18T23:14:13+00:00 app[web.1]:   app/models/user.rb:37:in `send_password_reset'
2012-07-18T23:14:13+00:00 app[web.1]: 
2012-07-18T23:14:13+00:00 app[web.1]:   app/controllers/password_resets_controller.rb:7:in `create'
2012-07-18T23:14:13+00:00 app[web.1]: Errno::ECONNREFUSED (Connection refused - connect(2)):

Anyone else had this problem? Any ideas how to fix this?

Thanks in advance!

You are a life saver Ryan. This episodes are golden.

Thank you.

I kept getting this when I tried to update my password:
ArgumentError in PasswordResetsController#update
comparison of Date with ActiveSupport::TimeWithZone failed

Fixed it by doing this:

if @user.password_reset_sent_at < 2.hours.ago.to_date

Hi, when I try to call the send_password_reset I get this error:

Validation failed: Password can't be blank, Password is too short (minimum is 6 characters), Password confirmation can't be blank

Does anyone can help me, please?

Hi when I try to reset password I get this error:
ArgumentError in PasswordResetsController#create

wrong number of arguments (1 for 0)

app/models/user.rb:48:increate_remember_token'
app/models/user.rb:40:in send_password_reset'
app/controllers/password_resets_controller.rb:7:increate'`

class PasswordResetsController < ApplicationController
  def new
  end

  def create
    user = User.find_by_email(params[:email])
    user.send_password_reset if user
    redirect_to root_url
  end

  def edit
    @user = User.find_by_password_reset_token!(params[:id])
  end

  def update
    @user = User.find_by_password_reset_token!(params[:id])
    if @user.password_reset_sent_at < 2.hours.ago
      redirect_to new_password_reset_path, :alert => "Password &crarr; 
        reset has expired."
    elsif @user.update_attributes(params[:user])
      redirect_to root_url, :notice => "Password has been reset."
    else
      render :edit
    end
end
end

class User < ActiveRecord::Base
  attr_accessible :email, :lname, :name, :password, :password_confirmation,
 
  has_secure_password

  before_save { |user| user.email = email.downcase }
  before_save :create_remember_token

  validates :name, presence: true, length: { maximum: 50 }
  validates :lname, presence: true, length: { maximum: 50 }
  VALID_EMAIL_REGEX = /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i
  validates :email, presence: true, format: { with: VALID_EMAIL_REGEX },
                    uniqueness: { case_sensitive: false }
  validates :password, presence: true, :on => :create
  validates :password, length: { minimum: 6 }, :allow_blank => true
  validates :password_confirmation, presence: true, :on => :create



  def send_password_reset
    create_remember_token(:password_reset_token)
    self.password_reset_sent_at = Time.zone.now
    save!
    UserMailer.password_reset(self).deliver
  end

  private

    def create_remember_token
      self.remember_token = SecureRandom.urlsafe_base64
    end
end

Have anybody an Idea why?

I'm missing something trivial here.

No route matches {:action=>"edit", :controller=>"password_resets", :locale=>"uI1CmPo8Le5HoO6BTwtlzQ"}

but I want to see the reset_token parameter here don't I?

Now I have

def send_password_reset
    create_remember_token
    self.password_reset_sent_at = Time.zone.now
    save!
    UserMailer.password_reset(self).deliver
  end

 

    def create_remember_token
      self.remember_token = SecureRandom.urlsafe_base64
    end

and now I have problem with find user
undefined methodfind_by_create_remember_token!' for #Class:0x007fca97926210`

nm,

it was because of the non-restful reset link in the mail template.

Because I'm using multi-tenancy, and locales this is what my password_reset method must look like:

def password_reset(user, account)
  @user = user
  @account = account
  @reset_url = "https://#{account.subdomain}.notdienstapp.com/password_resets/#{user.password_reset_token}/edit"
  mail :to => user.email, :subject => "Password Reset"
end

hmm..I have same problem 'Validation failed: Password can't be blank, Password is too short (minimum is 6 characters)'

'app/models/user.rb:64:in send_password_reset'
app/controllers/password_resets_controller.rb:9:increate'

For anyone who is working with different locales (like Remmington above), make sure your mailer template looks something like this:

<%= edit_password_reset_path(@user, :locale => I18n.locale, :password_reset_token => @user.password_reset_token) %>

Especially when you have routes like these:

scope '(:locale)' do
  resources :password_resets
end

It took me ages to figure that out...

Sorry, better use this:

<%= edit_password_reset_path(@user.password_reset_token, :locale => "#{I18n.locale}") %>

Hi everyone and thank you Ryan for this great screencast

I have an issue with the password reset edit form. The reset url is correctly generate and I can access the form, but my update action doesn't seem to work. Actually, I can send my form with empty fields for "password" and "password confirmation" and it will still trigger the "Password has been reset!" notice.

It looks as though my user validations aren't being taken into account here.

I tried adding both password and password confirmation validation to my User model:

validates :username, :email, :password, :password_confirmation, :presence => true

which is weird because when creating a new user, I didn't need those validations (the has_secure_password feature seemed to implement these validations), but the edit reset password form seems to need them.

Anyway, my edit_password_reset form worked, but it broke my new_password_reset form because it required both non blank password and password confirmation.

What am I missing here?

HI Ryan,

Well done on this one. I followed all your steps and it worked like a charm.

NOTE: I did have to restart the server after modifying the development.rb file. Any others who run into any weird snags along the way, just restart your server before trying anything else.

Hi, when I click the reset password button its giving me a validation error saying Validation failed: Password can't be blank?
Any help? I'm quite new to this?

Hi All,

Has anyone been able to figure out the "Validation failed: Password can't be blank, Password is too short (minimum is 6 characters" error when hitting Reset Password Submission button.

Please help???

Thanks in advance.

For all the guys with this problem:
"Validation failed: Password can't be blank, Password is too short minimum is 6
characters"

the solution is just change the line

  save!

and use instead

save!(validate: false)

This validation subject is getting complex...

Let's say I validate like this:

 validates :password, :password_confirmation, :presence => true

and I use the tip above:

save!(validate: false)

This works perfectly. But If I don't want the user to confirm the password every time he saves the profile I would do like this.

validates :password, :password_confirmation, :presence => true, :if => :password

This works too. Even validates on the reset password form and ask for confirmation if the password changes on the profile. But, it has a problem. if I submit the reset password form without any value for the password or password_confirmation it won't validate the presence of :password or :password_confirmation. The password won't be updated but it'll be nice to show the validation errors for presence in this scenario.

I don't know if any one has this issue, but I would appreciate some light here.

Thanks

Ryan,

Great episode. When a person creates a new account, there is no remember me functionality and his session is not automatically stored after creating a new account.

In episode #270, you showed us how to accomplish this by adding the following code (and adding : session[:user_id] = @user.id)

def create
    @user = User.new(params[:user])
    if @user.save
      session[:user_id] = @user.id
      redirect_to root_url, notice: "Thank you for signing up!"
    else
      render "new"
    end

How would we accomplish this being that we are not using the session and we are now using the cookie?

Louis

Hi Ryan,
Good screencast and help all newbies to learn rails easily.
I am using rails 4 and encountered one problem.

In password_resets_controller.rb you do:

elsif @user.update_attributes(params[:user])

IN console it showing
ActiveModel::ForbiddenAttributesError in PasswordResetsController#update

I don't know how to solve this issue.Please help me to solve this issue.

Thanks for the railscast, can't tell you how many times this it's helped me on projects. I was trying this out but I seem to have a problem when the user clicks on the password reset link from their email I get an error saying that it cant find the user with the password reset token

`ActiveRecord::RecordNotFound in PasswordResetsController#edit

Couldn't find User with password_reset_token = eydSfVtGn2gBQyNJP0o9jA`

Excellent ScreenCast .
Thanks Ryan for all the hard work you put out there.
Hope to hear from you soon.

I like the screencast... It works, but how do you get it to work in production? like specifically? I've tried to figure out what to put in my production.rb file but can't find a single thing telling me what to do.

Thanks for this one more time amazing railscast !

I couldn't figure out for the life of me why current_user was returning nil with the new cookies authentication. I was using an old user for which there had been no auth token generated... if anyone else encounters the same there ya go. Make a new user or clear the db.

hey im having some problems i dont know if you can help me out?

There is always a security concern when it comes to authenticating users. We'd better to stick with session over cookie when we store authenticated user details. Cookie is only suited for storing the remember me flag, but not for the authorization hash.