
Best practice for password strategies
Reported by Peter Zingg | November 16th, 2008 @ 02:15 PM
I am using authlogic in an application (just a shell right now). A couple of things I wanted to do, but not sure I did in the most efficient way:
- support for multiple openID identities
- support for case-insensitive passwords
- support for different strategy for generated passwords
- support for lost password, etc.
- support for tokens shorter then 128 characters, especially when used in email activation messages
To get things working I did what I think are a couple of hacks: I had to create an empty "AuthenticatedSystem" module and had to stub out a few method in my user class to get the open_id_authentication plugin to load.
And I had a little frustration in the case-insensitive password. Ideally I would just use authlogic's configuration to override the valid_password method, but I also want to take control of the storing of the password at create time. Please see:
http://github.com/pzingg/baseapp-openid/tree/master/app/models/user.rb
for my user class, with very non-DRY overrides of
User#password=
User#valid_password? and
User#reset_password!
and what I did to truncate authlogic's unique_token in
User#make_activation_code
User#make_password_reset_code
The other thing I did was alias_method :make_token, :unique_token to be name-compatible with the restful_authentication stubs.
I'm sure you could add configuration options that would make this password stuff configurable, or maybe I missed a clean way of doing it with the existing configuration possibilities.
Comments and changes to this ticket
-
-
Martinez December 25th, 2021 @ 05:20 AM
You can get official Myaarpmedicare Access at Myaarpmedicare.com. The organization is working for old-aged people, so it is obvious that only they can get a membership.
-
meriching February 18th, 2022 @ 03:36 AM
The term Electric bikes may refer to: Electric motorcycles and scooters · Electric bicycles ... Electric bikes.
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป
Object based authentication solution that handles all of the non sense for you. It's as easy as ActiveRecord is with a database.