Authentication: Rails 8
This course reads the authentication system that bin/rails generate authentication produces in Rails 8, quoting its installed templates and source. It covers the Authentication concern, Current, the database-backed Session model, SessionsController, User.authenticate_by and the rate_limit controller DSL. It then reads this app's hand-built system: Identity::User, Identity::Current, Auth::SessionsController and Auth::AuthenticateUserService, with its timing protection and account lockout. A comparison sets out what each system has and lacks. The course closes with a small Ruby challenge based on the lockout logic.
What you'll learn
- ✓The files, routes and migrations the Rails 8 authentication generator creates
- ✓How the Authentication concern, Current and a Session row track each login
- ✓How User.authenticate_by and rate_limit work, read from installed Rails source
- ✓How a session stored in Rails' default encrypted cookie differs from a database-backed one
- ✓Timing protection with a boot-time dummy digest and account lockout after repeated failures
- ✓The tradeoffs between the generator's baseline and a hand-built system
bin/rails generate authentication: Rails 8's generator
bin/rails generate authentication ships inside railties-8.1.3.1, the Rails version this app runs, and its USAGE file says what it does:
Read the full lesson free →Curriculum
7 lessonsbin/rails generate authentication: Rails 8's generator
What bin/rails generate authentication creates: models, controllers, a concern, mailers, routes, migrations and the bcrypt setup.
The generated concern, Current, and a database-backed session
How the generated concern protects every action by default, and how Current and a Session row track logins.
SessionsController, User.authenticate_by and rate_limit
The generated SessionsController, plus the installed source of User.authenticate_by and the cache-backed rate_limit DSL.
This app's own system: Identity::User, Identity::Current, Auth::SessionsController
This app's own system, which keeps session[:user_id] in Rails' default encrypted cookie without a Session model.
Auth::AuthenticateUserService: security beyond the generator's baseline
How Auth::AuthenticateUserService uses a boot-time dummy digest against timing enumeration and adds account lockout.
The tradeoff: what each system has, and what it doesn't
A comparison of revocable sessions, sign-in throttling, timing protection and lockout in the generator and this app.
Putting it together: two systems, four tradeoffs
A recap of both systems and their four tradeoffs, closing with a Ruby challenge based on the lockout logic.