Does Authlogic could to working with Mongomapper (a wrapper to MongoDB)?

https://railstips.org/2009/6/27/mongomapper-the-rad-mongo-wrapper

https://github.com/binarylogic/authlogic/blob/81af95e639570822667ec817f42aaad54f8865ed/lib/authlogic/random.rb#L16

By default SecureRandom [1] uses 16 bytes (which has an entropy of 128 bits [2]), so:

SecureRandom.base64(15).tr('+/=', '-_ ').strip.delete("\n")

should be:

SecureRandom.base64().tr('+/=', '-_ ').rstrip

[1] https://api.rubyonrails.org/classes/ActiveSupport/SecureRandom.html#M001107

[2] https://bitbucket.org/ares/cryha/src/tip/doc/sym_crypto.txt#cl-113

https://github.com/binarylogic/authlogic/blob/81af95e639570822667ec817f42aaad54f8865ed/lib/authlogic/random.rb#L11

SecureRandom.hex(64)

Why do use 64 bytes?

It shoulds be

SecureRandom.hex()

which uses 16 random bytes to return them into a hexadecimal string.

Use hash instead of encrypted

Another thing. I've seen that it's used 'encrypted' or 'crypted' to refer to the hashs. An hash is not a cryptographic algorithm, they are both different. Please use 'hash' to refer a SHA and any term related to crypto. to refer to AES.

• The salt is being saved in base64 getting 22 chars but If it's stored as bytes strings it were only 16 chars. The difference is very great when you have 100K o 1M of users.

• The same happens with the hashes which are being saved in hexadecimal, althought the difference is a lot of great.

Digest::SHA512.hexdigest => 128 chars.

instead of

Digest::SHA512.digest => 64 chars.

I am not sure if this bug is related to authlogic not being compatible with rails 2.3.3 or not, but I encounter an undefined method 'rewind' for # error when attempting to login using authlogic. This only occurs for me when attempting to use Rails 2.3.3. Once I switch back to 2.3.2 everything works fine. Here is a backtrace:

Status: 500 Internal Server Error undefined method `rewind' for #<TCPSocket:0x2536630>

/Library/Ruby/Gems/1.8/gems/rack-1.0.0/lib/rack/request.rb:150:in `POST'
/Library/Ruby/Gems/1.8/gems/rack-1.0.0/lib/rack/methodoverride.rb:15:in `call'
/Library/Ruby/Gems/1.8/gems/actionpack-2.3.3/lib/action_controller/params_parser.rb:15:in `call'
/Library/Ruby/Gems/1.8/gems/actionpack-2.3.3/lib/action_controller/session/cookie_store.rb:93:in `call'
/Library/Ruby/Gems/1.8/gems/actionpack-2.3.3/lib/action_controller/reloader.rb:29:in `call'
/Library/Ruby/Gems/1.8/gems/actionpack-2.3.3/lib/action_controller/failsafe.rb:26:in `call'
/Library/Ruby/Gems/1.8/gems/rack-1.0.0/lib/rack/lock.rb:11:in `call'
/Library/Ruby/Gems/1.8/gems/rack-1.0.0/lib/rack/lock.rb:11:in `synchronize'
/Library/Ruby/Gems/1.8/gems/rack-1.0.0/lib/rack/lock.rb:11:in `call'
/Library/Ruby/Gems/1.8/gems/actionpack-2.3.3/lib/action_controller/dispatcher.rb:106:in `call'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/rack/request_handler.rb:65:in `process_request'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_request_handler.rb:197:in `main_loop'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/railz/application_spawner.rb:340:in `start_request_handler'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/railz/application_spawner.rb:298:in `handle_spawn_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/utils.rb:176:in `safe_fork'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/railz/application_spawner.rb:296:in `handle_spawn_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:332:in `__send__'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:332:in `main_loop'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:182:in `start_synchronously'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:149:in `start'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/railz/application_spawner.rb:192:in `start'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/spawn_manager.rb:260:in `spawn_rails_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server_collection.rb:121:in `lookup_or_add'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/spawn_manager.rb:254:in `spawn_rails_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server_collection.rb:75:in `synchronize'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server_collection.rb:74:in `synchronize'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/spawn_manager.rb:253:in `spawn_rails_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/spawn_manager.rb:148:in `spawn_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/spawn_manager.rb:285:in `handle_spawn_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:332:in `__send__'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:332:in `main_loop'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:182:in `start_synchronously'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/bin/passenger-spawn-server:50

I can't seem to find any information in the docs on how to remove the "_ is not valid" validations on the user session fields. generalize_credentials_error_messages did not seem to return the results I was looking for. Is there a way to remove the validations completely for email/login/password and only use the validates_presence_of. Thank you.

It would be really great with a dead simple example showing how to create an Authlogic "add on".

Hi

With 2.3.3 I started to see strange ’A copy of ApplicationController has been removed from the module tree but is still active!’ errors every few requests. Switching back to 2.3.2 removed the problem.

I think I was able to locate the problem somewhere within authlogic.

It might have something to do with this outstanding ticket (https://rails.lighthouseapp.com/projects/8994/tickets/1339-arbase-should-not-be-nuking-its-children-just-because-it-lost-interest), but so far I haven’t seen any activity in it.

The problem can be reproduced by fetching my fork of the authlogic example application:

• https://github.com/retoo/authlogic_example/tree/rails233bug
• cp config/database.yml{-bug-example,} (or use your own, shoudln’t matter)
• rake db:migrate
• start server
• register a user
• fetch the page right after the registration (users/show) repeatedly and fast (keep reload button pressed)
• The error should occour withhin 10-30 requests,

Now if you like you can switch back to 2.3.2 and repeat the test, with 2.3.2 nothing happens.

Attached you can find the full backtrace.

Thanks!

Cheers,
Reto

original LH ticket

This ticket has 1 attachment(s).

My User class has a boolean field named "enabled". I’d like to prevent the login if that field is set to false. I found here an example code:
https://rdoc.info/rdoc/binarylogic/authlogic/blob/72992b9effaea12f109465fc904fa5431538775a/Authlogic/Session/Validation/Errors.html

class UserSession

validate :check_if_awesome
private
  def check_if_awesome
    errors.add(:login, "must contain awesome") if login && !login.include?("awesome")
    errors.add(:base, "You must be awesome to log in") unless attempted_record.awesome?
  end

end

that I’ve adapted into this:

class UserSession < Authlogic::Session::Base

validate :check_if_user_enabled
private
    def check_if_user_enabled
        debugger
#        User.find_by_login(object.login).enabled
    end

end

so, why does UserSession doesn’t inherit from Authlogic::Session::Base ?
Moreover, using the debugger I can’t see the "errors" object, I can only access to it by "object.errors".

so, if I’m not doing anything wrong, the problem in this ticket should only be about syncing this to the documentation.

Maurizio De Magnis

original LH ticket

This ticket has 0 attachment(s).

I have a fairly generic setup of Authlogic using all defaults against a User table in my primary DB.

I have a 2nd separate database setup in my database.yml/models ala something like..

In database.yml ... a second_db entry

In an example model...
class ModelInOtherDB < ActiveRecord::Base
establish_connection :second_db ... end

Whenever I use this MonelInOtherDB .. it works but when I reload the authlogic tries hitting the 2nd database not the primary DB with the User in it and faults with a ...

Could not find table ’user’ error

Authlogic(2.1.1)
Ruby version 1.9.1 (i386-darwin9.6.0)
RubyGems version 1.3.3

original LH ticket

This ticket has 0 attachment(s).

View

@@@ - if current_user %p= "Signed in as " << current_user.email << "!" %p= current_user_session.remember_me? - else %h1 Login %p

- form_for :login_info, :url => login_path do |f|
  = f.label :email
  = f.text_field :email
  = f.label :password
  = f.password_field :password
  = f.submit "Submit"
  = f.check_box :remember_me
  = f.label :remember_me

@@@

Controller

@@@ class UserSessionsController < ApplicationController before_filter :require_no_user, :only => :create before_filter :require_user, :only => :destroy

def create

user_session = UserSession.new(params[:login_info])
if user_session.save
  flash[:notice] = "Logged in!"
  redirect_to home_path
else
  flash[:error] = "Error: Login unsuccessful!"
  redirect_to home_path
end

end

def destroy

current_user_session.destroy
flash[:notice] = "Logged out!"
redirect_to home_path

end end @@@

Problem

Now when I login with the option ’Remember me?’ checked, Rails passes: @@@ Processing UserSessionsController#create (for 127.0.0.1 at 2009-07-11 03:39:15) [POST] Parameters: {"commit"=>"Submit", "action"=>"create", "controller"=>"user_sessions", "login_info"=>{"password"=>"[FILTERED]", "remember_me"=>"1", "email"=>"c00lryguy@gmail.com"}} @@@

But the View displays: @@@ Signed in as c00lryguy@gmail.com! false @@@

No matter how hard I try I can’t get the current_user_session to remember the remember_me option.

original LH ticket

This ticket has 0 attachment(s).

I’m using authlogic_openid version 1.0.4 because of problems with the current version of authlogic_openid. The error exists in the demo at https://authlogicexample.binarylogic.com/ as well.

Visit the demo. Enter https://google.com (or some other non-OpenID aware URL).

The problem is that the save block never gets yielded to. Here is the Mongrel output from my development environment: [OPENID] No usable OpenID services were found for "https://google.com/"

A similar problem exists when a URL to a non-existing server is entered: [OPENID] Failed to fetch identity URL https://b.com/ : Error fetching https://b.com/: getaddrinfo: Name or service not known

Best,

Daniel

original LH ticket

This ticket has 0 attachment(s).

HTTP Basic authentication works when going through curl, but not when using a browser (safari or firefox). In firefox, the attached dialog shows up. This happens in all of my projects using authlogic and the authlogic_example application from github. It’s the same whether I use mongrel or passenger.

original LH ticket

This ticket has 2 attachment(s).

I added a translations file for AuthLogic to my rails app. This correctly resulted in error messages for users being translated into the default locale. However, when I change the locale in a before filter, AuthLogic keeps returning error messages in the default locale while AR starts providing validation errors in the current locale. It seems like the call to I18n translate (t) is being made only once with the default locale when the AuthLogic gem is loaded.

original LH ticket

This ticket has 0 attachment(s).

Hey there.

Ran into a couple of problems customising the error messages that Authlogic raises using the I18n functionality, stemming from a couple of inaccuracies in your RDOC.

Firstly, this example (from https://rdoc.info/rdoc/binarylogic/authlogic/blob/81af95e639570822667ec817f42aaad54f8865ed/Authlogic/I18n.html):>

START CODE

# you will have key which will be something like: "error_messages.password_invalid"
# you will also have options[:default], which will be the default english version of the message
# do whatever you want here with the arguments passed to you.

original LH ticket

This ticket has 0 attachment(s).

Hello, I think there still are some keys missing.

I can’t translate during validation :

model names :

user_session user

attributes :

all the attributes for user

The rest is working just fine.

I’m using the latest gem.

original LH ticket

This ticket has 0 attachment(s).

Using authlogic with models that extend the User class (using Single Table Inheritance)
seems to break things since you end up with nil objects for @current_user in your controllers

@@@ ruby class User < ActiveRecord::Base

 acts_as_authentic

end class NormalUser < User;end class SpecialUser < User;end @@@

Is it possible to use authlogic with STI?

original LH ticket

This ticket has 0 attachment(s).

The regex in regex.rb for the login field currently is:

/\A\w[\w.+-_@ ]+\z/

This requires the login field to be a minimum of two characters. Shouldn't the first \w be removed or the + be changed to a *? I figure it makes most sense to remove the \w.