Does Authlogic could to working with Mongomapper (a wrapper to MongoDB)?

https://railstips.org/2009/6/27/mongomapper-the-rad-mongo-wrapper

https://github.com/binarylogic/authlogic/blob/81af95e639570822667ec817f42aaad54f8865ed/lib/authlogic/random.rb#L16

By default SecureRandom [1] uses 16 bytes (which has an entropy of 128 bits [2]), so:

SecureRandom.base64(15).tr('+/=', '-_ ').strip.delete("\n")

should be:

SecureRandom.base64().tr('+/=', '-_ ').rstrip

[1] https://api.rubyonrails.org/classes/ActiveSupport/SecureRandom.html#M001107

[2] https://bitbucket.org/ares/cryha/src/tip/doc/sym_crypto.txt#cl-113

https://github.com/binarylogic/authlogic/blob/81af95e639570822667ec817f42aaad54f8865ed/lib/authlogic/random.rb#L11

SecureRandom.hex(64)

Why do use 64 bytes?

It shoulds be

SecureRandom.hex()

which uses 16 random bytes to return them into a hexadecimal string.

Use hash instead of encrypted

Another thing. I've seen that it's used 'encrypted' or 'crypted' to refer to the hashs. An hash is not a cryptographic algorithm, they are both different. Please use 'hash' to refer a SHA and any term related to crypto. to refer to AES.

• The salt is being saved in base64 getting 22 chars but If it's stored as bytes strings it were only 16 chars. The difference is very great when you have 100K o 1M of users.

• The same happens with the hashes which are being saved in hexadecimal, althought the difference is a lot of great.

Digest::SHA512.hexdigest => 128 chars.

instead of

Digest::SHA512.digest => 64 chars.

I am not sure if this bug is related to authlogic not being compatible with rails 2.3.3 or not, but I encounter an undefined method 'rewind' for # error when attempting to login using authlogic. This only occurs for me when attempting to use Rails 2.3.3. Once I switch back to 2.3.2 everything works fine. Here is a backtrace:

Status: 500 Internal Server Error undefined method `rewind' for #<TCPSocket:0x2536630>

/Library/Ruby/Gems/1.8/gems/rack-1.0.0/lib/rack/request.rb:150:in `POST'
/Library/Ruby/Gems/1.8/gems/rack-1.0.0/lib/rack/methodoverride.rb:15:in `call'
/Library/Ruby/Gems/1.8/gems/actionpack-2.3.3/lib/action_controller/params_parser.rb:15:in `call'
/Library/Ruby/Gems/1.8/gems/actionpack-2.3.3/lib/action_controller/session/cookie_store.rb:93:in `call'
/Library/Ruby/Gems/1.8/gems/actionpack-2.3.3/lib/action_controller/reloader.rb:29:in `call'
/Library/Ruby/Gems/1.8/gems/actionpack-2.3.3/lib/action_controller/failsafe.rb:26:in `call'
/Library/Ruby/Gems/1.8/gems/rack-1.0.0/lib/rack/lock.rb:11:in `call'
/Library/Ruby/Gems/1.8/gems/rack-1.0.0/lib/rack/lock.rb:11:in `synchronize'
/Library/Ruby/Gems/1.8/gems/rack-1.0.0/lib/rack/lock.rb:11:in `call'
/Library/Ruby/Gems/1.8/gems/actionpack-2.3.3/lib/action_controller/dispatcher.rb:106:in `call'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/rack/request_handler.rb:65:in `process_request'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_request_handler.rb:197:in `main_loop'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/railz/application_spawner.rb:340:in `start_request_handler'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/railz/application_spawner.rb:298:in `handle_spawn_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/utils.rb:176:in `safe_fork'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/railz/application_spawner.rb:296:in `handle_spawn_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:332:in `__send__'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:332:in `main_loop'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:182:in `start_synchronously'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:149:in `start'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/railz/application_spawner.rb:192:in `start'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/spawn_manager.rb:260:in `spawn_rails_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server_collection.rb:121:in `lookup_or_add'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/spawn_manager.rb:254:in `spawn_rails_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server_collection.rb:75:in `synchronize'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server_collection.rb:74:in `synchronize'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/spawn_manager.rb:253:in `spawn_rails_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/spawn_manager.rb:148:in `spawn_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/spawn_manager.rb:285:in `handle_spawn_application'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:332:in `__send__'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:332:in `main_loop'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/lib/phusion_passenger/abstract_server.rb:182:in `start_synchronously'
/Library/Ruby/Gems/1.8/gems/passenger-2.1.2/bin/passenger-spawn-server:50

I can't seem to find any information in the docs on how to remove the "_ is not valid" validations on the user session fields. generalize_credentials_error_messages did not seem to return the results I was looking for. Is there a way to remove the validations completely for email/login/password and only use the validates_presence_of. Thank you.

It would be really great with a dead simple example showing how to create an Authlogic "add on".

Hi

With 2.3.3 I started to see strange ’A copy of ApplicationController has been removed from the module tree but is still active!’ errors every few requests. Switching back to 2.3.2 removed the problem.

I think I was able to locate the problem somewhere within authlogic.

It might have something to do with this outstanding ticket (https://rails.lighthouseapp.com/projects/8994/tickets/1339-arbase-should-not-be-nuking-its-children-just-because-it-lost-interest), but so far I haven’t seen any activity in it.

The problem can be reproduced by fetching my fork of the authlogic example application:

• https://github.com/retoo/authlogic_example/tree/rails233bug
• cp config/database.yml{-bug-example,} (or use your own, shoudln’t matter)
• rake db:migrate
• start server
• register a user
• fetch the page right after the registration (users/show) repeatedly and fast (keep reload button pressed)
• The error should occour withhin 10-30 requests,

Now if you like you can switch back to 2.3.2 and repeat the test, with 2.3.2 nothing happens.

Attached you can find the full backtrace.

Thanks!

Cheers,
Reto

original LH ticket

This ticket has 1 attachment(s).

My User class has a boolean field named "enabled". I’d like to prevent the login if that field is set to false. I found here an example code:
https://rdoc.info/rdoc/binarylogic/authlogic/blob/72992b9effaea12f109465fc904fa5431538775a/Authlogic/Session/Validation/Errors.html

class UserSession

validate :check_if_awesome
private
  def check_if_awesome
    errors.add(:login, "must contain awesome") if login && !login.include?("awesome")
    errors.add(:base, "You must be awesome to log in") unless attempted_record.awesome?
  end

end

that I’ve adapted into this:

class UserSession < Authlogic::Session::Base

validate :check_if_user_enabled
private
    def check_if_user_enabled
        debugger
#        User.find_by_login(object.login).enabled
    end

end

so, why does UserSession doesn’t inherit from Authlogic::Session::Base ?
Moreover, using the debugger I can’t see the "errors" object, I can only access to it by "object.errors".

so, if I’m not doing anything wrong, the problem in this ticket should only be about syncing this to the documentation.

Maurizio De Magnis

original LH ticket

This ticket has 0 attachment(s).

I have a fairly generic setup of Authlogic using all defaults against a User table in my primary DB.

I have a 2nd separate database setup in my database.yml/models ala something like..

In database.yml ... a second_db entry

In an example model...
class ModelInOtherDB < ActiveRecord::Base
establish_connection :second_db ... end

Whenever I use this MonelInOtherDB .. it works but when I reload the authlogic tries hitting the 2nd database not the primary DB with the User in it and faults with a ...

Could not find table ’user’ error

Authlogic(2.1.1)
Ruby version 1.9.1 (i386-darwin9.6.0)
RubyGems version 1.3.3

original LH ticket

This ticket has 0 attachment(s).

View

@@@ - if current_user %p= "Signed in as " << current_user.email << "!" %p= current_user_session.remember_me? - else %h1 Login %p

- form_for :login_info, :url => login_path do |f|
  = f.label :email
  = f.text_field :email
  = f.label :password
  = f.password_field :password
  = f.submit "Submit"
  = f.check_box :remember_me
  = f.label :remember_me

@@@

Controller

@@@ class UserSessionsController < ApplicationController
before_filter :require_no_user, :only => :create before_filter :require_user, :only => :destroy

def create

user_session = UserSession.new(params[:login_info])
if user_session.save
  flash[:notice] = "Logged in!"
  redirect_to home_path
else
  flash[:error] = "Error: Login unsuccessful!"
  redirect_to home_path
end

end

def destroy

current_user_session.destroy
flash[:notice] = "Logged out!"
redirect_to home_path

end end
@@@

Problem

Now when I login with the option ’Remember me?’ checked, Rails passes:
@@@ Processing UserSessionsController#create (for 127.0.0.1 at 2009-07-11 03:39:15) [POST]
Parameters: {"commit"=>"Submit", "action"=>"create", "controller"=>"user_sessions", "login_info"=>{"password"=>"[FILTERED]", "remember_me"=>"1", "email"=>"c00lryguy@gmail.com"}} @@@

But the View displays:
@@@ Signed in as c00lryguy@gmail.com!
false
@@@

No matter how hard I try I can’t get the current_user_session to remember the remember_me option.

original LH ticket

This ticket has 0 attachment(s).

I’m using authlogic_openid version 1.0.4 because of problems with the current version of authlogic_openid. The error exists in the demo at https://authlogicexample.binarylogic.com/ as well.

Visit the demo. Enter https://google.com (or some other non-OpenID aware URL).

The problem is that the save block never gets yielded to. Here is the Mongrel output from my development environment:
[OPENID] No usable OpenID services were found for "https://google.com/"

A similar problem exists when a URL to a non-existing server is entered:
[OPENID] Failed to fetch identity URL https://b.com/ : Error fetching https://b.com/: getaddrinfo: Name or service not known

Best,

Daniel

original LH ticket

This ticket has 0 attachment(s).

HTTP Basic authentication works when going through curl, but not when using a browser (safari or firefox). In firefox, the attached dialog shows up. This happens in all of my projects using authlogic and the authlogic_example application from github. It’s the same whether I use mongrel or passenger.

original LH ticket

This ticket has 2 attachment(s).

I added a translations file for AuthLogic to my rails app. This correctly resulted in error messages for users being translated into the default locale. However, when I change the locale in a before filter, AuthLogic keeps returning error messages in the default locale while AR starts providing validation errors in the current locale. It seems like the call to I18n translate (t) is being made only once with the default locale when the AuthLogic gem is loaded.

original LH ticket

This ticket has 0 attachment(s).

Hey there.

Ran into a couple of problems customising the error messages that Authlogic raises using the I18n functionality, stemming from a couple of inaccuracies in your RDOC.

Firstly, this example (from https://rdoc.info/rdoc/binarylogic/authlogic/blob/81af95e639570822667ec817f42aaad54f8865ed/Authlogic/I18n.html):>

START CODE

# you will have key which will be something like: "error_messages.password_invalid"
# you will also have options[:default], which will be the default english version of the message
# do whatever you want here with the arguments passed to you.

original LH ticket

This ticket has 0 attachment(s).

Hello, I think there still are some keys missing.

I can’t translate during validation :

model names :

user_session user

attributes :

all the attributes for user

The rest is working just fine.

I’m using the latest gem.

original LH ticket

This ticket has 0 attachment(s).

Using authlogic with models that extend the User class (using Single Table Inheritance)
seems to break things since you end up with nil objects for @current_user in your controllers

@@@ ruby class User < ActiveRecord::Base

 acts_as_authentic

end
class NormalUser < User;end
class SpecialUser < User;end
@@@

Is it possible to use authlogic with STI?

original LH ticket

This ticket has 0 attachment(s).

The regex in regex.rb for the login field currently is:

/\A\w[\w.+-_@ ]+\z/

This requires the login field to be a minimum of two characters. Shouldn't the first \w be removed or the + be changed to a *? I figure it makes most sense to remove the \w.

If I enable logout_on_timeout and try to use HTTP Basic Auth then Authlogic will not validate the session (JosUserSession.find.record returns nil)

User and UserSession models below. I'm using the the ApplicationController methods as shown in the tutorials.

class UserSession < Authlogic::Session::Base
  login_field :username
  verify_password_method :valid_credentials?
  logout_on_timeout true
  allow_http_basic_auth true
end 
class User < ActiveRecord::Base
  acts_as_authentic do |c| 
    c.validate_password_field = false
    c.login_field = :username
    c.logged_in_timeout = 30.minutes
  end 
  def valid_credentials?(password_plaintext)
    valid_jos_user_credentials?(password_plaintext)
  end 
  def valid_jos_user_credentials?(password_plaintext)
    salt = password.split(':')[1]
    encrypted = Digest::MD5.hexdigest("#{password_plaintext}#{salt}")
    password.eql? "#{encrypted}:#{salt}"
  end 
end 

I change a user's password through the console, then reload that user and the valid_password? returns false for the new password.

Any ideas where to look from here before I end up deep into the authlogic code?

Here's a console dump:

?> u.password = "foobar" => "foobar"

u.password_confirmation = "foobar" => "foobar" u.save! => true u.reload => # u.valid_password?("foobar") => false

Is there an easy way to merge validation options for all validations? I would like to disable validations when a user is registered as a guest and currently have to do this.

acts_as_authentic do |c|
  c.merge_validates_confirmation_of_password_field_options :unless => :guest?
  c.merge_validates_length_of_password_field_options :unless => :guest?
  c.merge_validates_length_of_password_confirmation_field_options :unless => :guest?
  c.merge_validates_length_of_login_field_options :unless => :guest
  c.merge_validates_format_of_login_field_options :unless => :guest
  c.merge_validates_uniqueness_of_login_field_options :unless => :guest
  c.merge_validates_format_of_email_field_options :unless => :guest
  c.merge_validates_length_of_email_field_options :unless => :guest
  c.merge_validates_uniqueness_of_email_field_options :unless => :guest
end

It would be nice if there was one merge_validation_options config method which merged all of them. Or is there a better way to do this?

to add email field do i just modify create_users.rb file and then run migration.Or are there other steps?
sorry I am a complete newbie

Creating a new instance automatically loads errors into @base and populates those errors on my sign in form:

(rdb:1) @account_session = AccountSession.new

<AccountSession: no credentials provided>

(rdb:1) @account_session.errors

<Authlogic::Session::Validation::Errors:0x213cc78 @errors={}, @base=#<AccountSession: no credentials provided>>

Is this correct behavior or am I missing something?

Gavin

irb> require 'rubygems' => true irb> require 'authlogic' NameError: uninitialized constant ActiveRecord

from ...
from /path/to/authlogic-2.1.1/lib/authlogic/session/validation.rb:16
from ...

Authlogic::Session::Validation::Errors inherits from ::ActiveRecord::Errors, but no require "active_record" can be found in the code and no dependency has been added to the gemspec.

Please note: In Rails 3, ActiveRecord::Errors has been moved to ActiveModel, so it might be better to roll your own Errors class.

Hi,
There are problem with UserSessions on rails 2.3.4. code in view like this

<% form_for @user_session, :url => login_path do |f| -%>
<%= f.error_messages %> <%= f.text_field :login %> <%= f.password_field :password %> <%= f.check_box :remember_me %> <%= submit_tag 'Login' %> <% end %>

causes ActionView::TemplateError (can't convert ActiveRecord::Error into String) on line <%= f.error_messages %>

It is missing there.

Hi,
I'm a happy user of Authlogic.
In my projects, manaed with Git, I have a pre-commit hook that checks all the modified files to see if they are valid. They go through Ruby or ERB syntax check and the commit is aborted if an error is raised.

When I pack my gems in "vendor/gems", they are added to the next commit checked.

This process stumbles upon the session template which ends on *.rb and so is checked by Ruby and so is not valid because it's in fact an ERB template.

Maybe this file could be renamed into something either .erb or .tpl, …

The exact file is : authlogic-2.1.1/generators/session/templates/session.rb

I'll try to fork and make a patch, but I'm not sure that's in my reach ;-)

Thanks for Authlogic and everything else that you make. It's great.
Cheers
Jeremy

Normally Rails would do this:

@object.errors[:non_existent_attribute] # => nil

Authlogic returns []

This is because of the following method:

class Errors < ::ActiveRecord::Errors
  def [](key)
    value = super
    value.is_a?(Array) ? value : [value].compact
  end
end

as an example:

nil.is_a?(Array) ? nil : [nil].compact # => []

This causes issues when using the Formtastic plugin which expects nil when there are no errors for a given attribute.

This would be a fix:

class Errors < ::ActiveRecord::Errors
  def [](key)
    value = super
    return nil if value.is_nil?
    value.is_a?(Array) ? value : [value].compact
  end
end

The doc specifies that instead of the value 'true' a string can be specified like this:

generalize_credentials_error_messages I18n.t('authlogic.error_messages.login_credentials_invalid')

However, this does not seem to work: when passing a string the whole statement is ignored.

Using Ruby 1.9.1 and Rails 2.3.4 i got that error

NoMethodError (undefined method ^' for "a":String):<br/> authlogic (2.1.1) lib/authlogic/session/session.rb:46:insession_credentials' authlogic (2.1.1) lib/authlogic/session/session.rb:33:in persist_by_session' authlogic (2.1.1) lib/authlogic/session/callbacks.rb:78:inpersist' authlogic (2.1.1) lib/authlogic/session/persistence.rb:55:in persisting?' authlogic (2.1.1) lib/authlogic/session/persistence.rb:39:infind' app/controllers/application_controller.rb:16:in `current_user_session'

AuthLogic helps an attacker by letting them know if a username is valid or not while logging in.

A more secure (but slightly less user-friendly) behavior would be not letting the user know whether the login or password (or both) is wrong.

I think the secure behavior should be enabled by default, and have a configuration parameter to behave in the current mode.

(note that information might also be leaked from the register and forgotten password page)

Logout works on my local machine (mac os x leopard, rails 2.3.4, mongral) but fails on Production in Heroku.