{"repo":"adamcooke/authie","free":true,"listed":false,"github":"https://github.com/adamcooke/authie","clone":"git clone https://github.com/adamcooke/authie.git","description":"👮‍♂️ Improve user session security in Ruby on Rails applications with database session storage","language":"Ruby","stars":245,"topics":["rails","authentication","ruby","session-cookie","persistent-sessions"],"license":"MIT","category":"auth-billing-email","readme_excerpt":"Authie This is a Rails library which provides applications with a database-backed user sessions. This ensures that user sessions can be invalidated from the server and users activity can be easily tracked. The \"traditional\" way of simply setting a user ID in your session is insecure and unwise. If you simply do something like the example below, it means that anyone with access to the session cookie can login as the user whenever and wherever they wish. To clarify: while by default Rails session cookies are encrypted, there is nothing to allow them to be invalidated if someone were to \"steal\" an encrypted cookie from an authenticated user. This could be stolen using a MITM attack or simply by stealing it directly from their browser when they're off getting a coffee. The design goals behind Authie are: - Any session can be invalidated instantly from the server without needing to make changes to remote cookies. - We can see who is logged in to our application at any point in time. - Sessions should automatically expire after a certain period of inactivity. - Sessions can be either permanent or temporary. Installation As usual, just pop this in your Gemfile: You will then need add the database tables Authie needs to your database. You should copy Authie's migrations and then migrate. Usage Authie is just a session manager and doesn't provide any functionality for your authentication or User models. Your User model should implement any methods needed to authenticate a username & p","default_branch":null,"files":null,"tree":[],"storefront":"/r/adamcooke","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/adamcooke/authie/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}