Authentication Strategies

By: Johnathon Wright on: January 30, 2017

Just thinking about all the possible authentication strategies and tokens:

Single Auth Token

As a user, I want to authenticate for a single request, no session or authentication persistence, for API purposes or downloads. I assume it was a thing before this, but I was introduced to it by AuthLogic, long may it reign.

Looks like:

POST domain.test/invoices.xml?token=sometokenhere

or

GET domain.test/reports/65432.pdf?token=sometokenhere

Instance-based key

As a user, I want to be able to send a link to a non-user so that they can look at just this one page without having to authenticate because I know they should have access to this one piece of information.

Looks like:

GET domain.test/reports/65432.pdf?key=sometokenhere
  • You wouldn't want to use the same param as for auth-based
  • You can either store a key OR you can derive one based on some set of fields. Note that in the first case, you can reset the token if it becomes exposed. In the second case, you gain simplicity. Each case must be judged on its own merits.

Here's an example of generating a token based on some input:

def token(seed)
  sha256 = Digest::SHA256.new
  digest = sha256.digest(seed.to_s + SOME_SECRET_CONSTANT)
  return Digest.hexencode(digest)[0..10]
end

Perishable Token

As a user, I want to authenticate and create a session using a token that expires when used OR after some short lifespan so that I can reset passwords.

This idea also came to me through AuthLogic, long may it reign.

One tricky thing about perishable tokens. You need them to create a session because you're going to (a) show a form and (b) change the password. But some developers might want the user to have to login after resetting the password, and wouldn't want them to see a menu that would allow them to not reset their password. So you have to add some extra logic around being partially authenticated, or allow the perishable token to live past its first use. So that's weird.

In the past I've put this token on the user. But I'm starting to think it belongs in its own table now.

perishable_tokens table:

  • key
  • user_id
  • created_at - datetime
  • expires_at - datetime
  • used_at - datetime
  • rescinded_at - datetime - an administrator may choose to rescind one or all open tokens

This way you keep a history of attempts, which may be interesting in terms of finding patterns if you suspect some kind of And obviously if expiresat is in the past or usedat is not NULL, it isn't valid. And you might want some validation around not having more than one per user.

Link-Through Authentication

As a lazy user, I want a link in an email to log me in automatically.

Everyone is booing. I hear you. I know, it flies in the face of web security. Banks should avoid this. But I saw it being done by Motley Fool and I think it's a good fit for their audience. Probably older. Probably not tech savvy.

I don't mind it. If you own the email address you own the account, so who cares.

One thing is how long these links should live. Fool.com sends you a one-use link. But there are some very-low-security sites for which auth-until-password-reset might be ok!

Any others?





Comments:

cheap jordans said: I have to voice my appreciation for your kind-heartedness for those who really need help with in this area of interest. Your very own commitment to getting the solution around came to be exceptionally significant and has continually permitted girls just like me to get to their targets. Your personal interesting tutorial implies so much a person like me and a whole lot more to my mates. Regards; from everyone of us. cheap jordans [url=http://www.air-jordanshoes.us.org]cheap jordans[/url]

calvin klein underwear said: I intended to write you this very small word to help say thanks the moment again about the incredible pointers you've provided above. It is so seriously generous with people like you in giving openly exactly what a lot of folks would have sold for an e book to get some profit on their own, even more so considering that you might have tried it if you ever considered necessary. Those good ideas likewise worked to be the great way to fully grasp many people have a similar dream much like mine to find out significantly more when it comes to this matter. I know there are some more enjoyable instances up front for those who read through your website. calvin klein underwear

kd shoes said: I simply wished to appreciate you once again. I'm not certain the things that I would have created without the actual solutions shared by you regarding such a area of interest. It actually was the frustrating scenario in my position, nevertheless spending time with a new specialized form you processed the issue took me to cry over fulfillment. I'm just grateful for the service and even sincerely hope you know what an amazing job that you're accomplishing teaching some other people via a web site. More than likely you've never encountered all of us. kd shoes

retro jordans said: I am only writing to let you be aware of of the cool experience my friend's princess obtained browsing your site. She even learned lots of things, with the inclusion of what it is like to possess an excellent helping style to have a number of people really easily know some very confusing issues. You undoubtedly surpassed readers' expectations. Thank you for supplying those insightful, healthy, informative and as well as fun guidance on this topic to Lizeth. retro jordans

nike air vapormax said: My wife and i were quite fortunate when Albert could finish off his analysis because of the precious recommendations he got out of your web page. It is now and again perplexing to just choose to be giving for free hints that the rest might have been making money from. We fully understand we need the website owner to give thanks to because of that. The type of explanations you made, the easy site navigation, the relationships your site help foster - it's got many astonishing, and it is helping our son and the family consider that the issue is brilliant, which is extremely vital. Many thanks for the whole thing! nike air vapormax

nike shox for women said: I enjoy you because of your whole effort on this web page. Gloria delights in getting into research and it's obvious why. I hear all relating to the powerful way you present both useful and interesting techniques on the website and as well attract contribution from the others on that topic then our favorite daughter is always studying so much. Enjoy the remaining portion of the new year. You're the one performing a terrific job. nike shox for women

birkin bag said: My wife and i ended up being very satisfied Michael managed to do his inquiry out of the ideas he had in your web site. It is now and again perplexing to simply be making a gift of tips and hints which many others may have been trying to sell. And we already know we have got the blog owner to give thanks to because of that. The main illustrations you have made, the straightforward website navigation, the relationships you can help create - it's most remarkable, and it is helping our son and us believe that the issue is entertaining, and that's particularly pressing. Thanks for the whole lot! birkin bag

yeezy boost 350 said: I'm also writing to let you be aware of of the notable discovery my cousin's girl developed checking your web site. She mastered so many issues, which included what it's like to possess an amazing coaching spirit to get the mediocre ones really easily comprehend a number of impossible things. You actually surpassed people's expectations. Thanks for supplying such effective, dependable, educational and easy tips on your topic to Julie. yeezy boost 350

yeezy boost 350 v2 said: Thank you so much for providing individuals with such a splendid opportunity to read critical reviews from this site. It's always very nice and as well , packed with fun for me and my office peers to search the blog a minimum of thrice in one week to study the new guides you will have. And lastly, we're at all times satisfied concerning the striking methods you give. Selected 3 points in this article are absolutely the most efficient we have had. yeezy boost 350 v2

supreme clothing said: An impressive share, I just given this onto a colleague who was doing a little analysis on this. And he in truth purchased me breakfast because I discovered it for him.. smile. So let me reword that: Thnx for the treat! But yeah Thnkx for spending the time to discuss this, I really feel strongly about it and love studying extra on this topic. If potential, as you grow to be expertise, would you thoughts updating your weblog with more details? It is extremely helpful for me. Large thumb up for this weblog put up! supreme clothing

lebron shoes said: It is best to participate in a contest for the most effective blogs on the web. I will suggest this site! lebron shoes

kobe basketball shoes said: There's noticeably a bundle to know about this. I assume you made sure nice factors in options also. kobe basketball shoes

yeezys said: An interesting discussion is value comment. I think that it's best to write more on this topic, it won't be a taboo subject however generally persons are not enough to speak on such topics. To the next. Cheers yeezys

jordan 12 said: Once I originally commented I clicked the -Notify me when new comments are added- checkbox and now every time a remark is added I get four emails with the same comment. Is there any approach you'll be able to remove me from that service? Thanks! jordan 12

golden goose outlet said: you've an excellent blog here! would you like to make some invite posts on my weblog? golden goose outlet

off white shoes said: You made some decent points there. I looked on the internet for the difficulty and located most individuals will go together with along with your website. off white shoes

balenciaga trainers said: Your house is valueble for me. Thanks!? balenciaga trainers

jordan shoes said: I found your weblog website on google and verify a few of your early posts. Proceed to keep up the excellent operate. I just additional up your RSS feed to my MSN News Reader. Seeking forward to studying extra from you in a while!? jordan shoes

kyrie 3 said: Aw, this was a very nice post. In thought I want to put in writing like this moreover ?taking time and actual effort to make an excellent article?however what can I say?I procrastinate alot and certainly not appear to get one thing done. kyrie 3

supreme new york said: I'm typically to running a blog and i actually respect your content. The article has really peaks my interest. I am going to bookmark your website and maintain checking for brand spanking new information. supreme new york

curry 6 said: Hey! I just wish to give a huge thumbs up for the great data you might have here on this post. I will likely be coming again to your weblog for more soon. curry 6

kd 12 said: An fascinating discussion is price comment. I think that it's best to write extra on this topic, it won't be a taboo subject but generally individuals are not enough to speak on such topics. To the next. Cheers kd 12

yeezy boost 350 v2 said: I am only commenting to let you understand of the fine discovery my child developed checking yuor web blog. She came to find numerous things, with the inclusion of how it is like to possess a wonderful teaching mood to let folks without problems gain knowledge of selected extremely tough matters. You truly surpassed her desires. I appreciate you for presenting such informative, healthy, revealing and in addition fun thoughts on that topic to Emily. yeezy boost 350 v2

golden goose outlet said: Needed to post you this tiny word to be able to give many thanks over again for these unique principles you have shown above. It has been generous of people like you to allow freely precisely what some people would've supplied for an e-book to earn some cash on their own, certainly given that you might well have done it in the event you considered necessary. The suggestions in addition acted like the fantastic way to realize that some people have similar interest just as my own to know much more pertaining to this issue. I know there are millions of more fun times in the future for individuals who go through your blog. golden goose outlet

nike off whtie said: I as well as my pals were looking at the good secrets from your site and then instantly I had a horrible suspicion I never expressed respect to the web site owner for them. Those young boys were absolutely warmed to read through all of them and have in actuality been making the most of those things. We appreciate you genuinely indeed accommodating and then for pick out variety of extraordinary information most people are really eager to learn about. My sincere regret for not expressing gratitude to you earlier. nike off whtie

yeezy boost 350 said: I intended to create you one very little remark to help thank you very much yet again for your personal amazing suggestions you've provided in this case. This has been certainly particularly generous of you to offer unreservedly exactly what a number of us could possibly have offered for an e-book in making some money for themselves, even more so given that you could have done it if you desired. The solutions likewise served as a good way to fully grasp other people online have a similar dreams the same as my very own to find out good deal more in terms of this issue. I'm certain there are lots of more fun occasions ahead for individuals that look into your site. yeezy boost 350

off white jordan 1 said: I wanted to develop a brief note in order to appreciate you for those amazing information you are giving out on this site. My extensive internet lookup has at the end been compensated with reasonable facts to go over with my partners. I would express that we visitors are very lucky to dwell in a perfect site with so many awesome people with interesting methods. I feel rather grateful to have come across the website page and look forward to tons of more cool moments reading here. Thanks a lot once more for a lot of things. off white jordan 1

yeezy boost 350 v2 said: I precisely desired to thank you so much again. I am not sure the things that I could possibly have sorted out in the absence of the ways shared by you concerning such subject matter. It has been a horrifying dilemma in my position, but being able to view the expert technique you dealt with that took me to cry for fulfillment. I'm just grateful for your support and in addition believe you are aware of an amazing job that you are undertaking teaching most people via your websites. Most probably you have never met all of us. yeezy boost 350 v2

kd13 said: I in addition to my pals have been studying the good tips and tricks on your website then before long developed an awful suspicion I never thanked the web blog owner for those strategies. These young boys appeared to be so glad to learn them and already have really been having fun with those things. I appreciate you for simply being so thoughtful and then for making a choice on this form of awesome topics most people are really desperate to be informed on. My very own honest regret for not expressing appreciation to earlier. kd13

balenciaga said: Thanks so much for giving everyone an extremely superb possiblity to read in detail from this blog. It is often so brilliant and also packed with a lot of fun for me personally and my office peers to search your blog on the least 3 times in 7 days to study the newest issues you have got. Of course, I'm certainly fulfilled concerning the amazing solutions you give. Selected 2 areas in this post are surely the most impressive we have all had. balenciaga

moncler said: I intended to create you this little observation to help give many thanks again for your personal great strategies you have contributed on this page. It's simply pretty generous with you to allow unhampered precisely what most of us could possibly have sold for an e-book in making some profit for their own end, principally considering that you could have tried it in case you considered necessary. These advice likewise worked like the great way to be aware that other individuals have the identical fervor just like my very own to grasp much more with regards to this issue. I'm sure there are some more pleasurable moments in the future for folks who go through your site. moncler

longchamp handbags said: I must get across my appreciation for your kind-heartedness in support of folks that really want help on this one area. Your very own commitment to getting the solution across was remarkably beneficial and have in most cases permitted somebody much like me to attain their dreams. Your entire interesting guidelines implies a whole lot a person like me and extremely more to my mates. Many thanks; from everyone of us. longchamp handbags

supreme outlet said: My spouse and i felt so excited that Edward managed to carry out his reports from your precious recommendations he gained using your blog. It is now and again perplexing to just always be freely giving helpful tips some people might have been making money from. And we also remember we've got the blog owner to be grateful to for that. The main illustrations you've made, the straightforward website navigation, the friendships you can help to create - it's got many astonishing, and it is assisting our son in addition to our family reckon that the situation is thrilling, and that is particularly fundamental. Thank you for everything! supreme outlet

yeezy 380 said: Thanks so much for providing individuals with an exceptionally terrific possiblity to read articles and blog posts from this site. It's usually very fantastic and as well , jam-packed with amusement for me and my office acquaintances to visit your web site on the least three times weekly to learn the new stuff you have got. Not to mention, I am just usually satisfied with your cool opinions served by you. Certain 1 areas in this post are completely the very best we have all ever had. yeezy 380

balenciaga said: I intended to post you this very small note in order to give thanks as before for these unique views you've shared in this case. It is so wonderfully open-handed with people like you to present easily all many people might have distributed as an e book to make some bucks for themselves, most importantly considering that you might well have done it in the event you decided. These principles in addition acted to become fantastic way to realize that some people have similar eagerness really like my own to realize more and more pertaining to this issue. Certainly there are some more pleasurable situations ahead for individuals who see your website. balenciaga

jordan shoes said: I have to express some appreciation to you just for rescuing me from this type of crisis. Just after researching through the the net and meeting basics that were not productive, I figured my life was done. Living minus the answers to the problems you have resolved as a result of your good posting is a crucial case, and ones which might have in a wrong way affected my entire career if I hadn't come across your web site. Your actual know-how and kindness in touching every aspect was helpful. I am not sure what I would have done if I hadn't come across such a step like this. It's possible to at this moment look forward to my future. Thanks so much for the expert and sensible guide. I will not think twice to suggest your web page to any person who requires assistance about this subject. jordan shoes

yeezy boost said: I definitely wanted to jot down a brief remark to be able to thank you for all of the marvelous advice you are showing on this website. My incredibly long internet search has now been recognized with reasonable facts and techniques to exchange with my relatives. I 'd repeat that many of us website visitors actually are really fortunate to dwell in a superb place with very many special individuals with very helpful points. I feel rather fortunate to have seen your site and look forward to many more excellent times reading here. Thanks a lot once more for a lot of things. yeezy boost

nike kyrie 6 said: I and my friends came taking note of the nice secrets and techniques on your site and all of a sudden came up with a horrible feeling I had not expressed respect to the blog owner for those tips. These people ended up so joyful to see them and have now in truth been loving these things. Thanks for actually being so helpful and then for obtaining variety of cool topics millions of individuals are really desirous to be informed on. Our own honest apologies for not expressing gratitude to you sooner. nike kyrie 6

birkin bag said: Needed to write you that very little remark to finally say thanks once again about the pleasant ideas you've discussed at this time. It's simply surprisingly generous of people like you to supply freely what exactly a few people could possibly have made available for an ebook to help make some bucks on their own, particularly now that you could have done it in the event you decided. The secrets also worked to provide a good way to fully grasp that someone else have a similar zeal much like mine to know the truth much more with regards to this problem. Certainly there are many more enjoyable opportunities up front for many who view your website. birkin bag

giannis shoes said: I have to show appreciation to you just for rescuing me from this particular dilemma. As a result of checking throughout the the net and coming across solutions which were not productive, I assumed my life was well over. Being alive devoid of the answers to the problems you have solved by means of your website is a serious case, as well as the kind that could have badly affected my career if I had not discovered the website. Your personal natural talent and kindness in touching all the stuff was very helpful. I am not sure what I would've done if I had not come upon such a solution like this. I can at this moment relish my future. Thanks so much for this skilled and result oriented help. I won't hesitate to refer the sites to anyone who should get guidelines about this subject matter. giannis shoes

stone island said: I would like to show some appreciation to you for rescuing me from such a trouble. Right after searching throughout the search engines and coming across solutions that were not pleasant, I was thinking my life was done. Existing without the presence of answers to the problems you have sorted out through this posting is a critical case, as well as ones that might have negatively affected my entire career if I hadn't encountered the website. Your main know-how and kindness in playing with everything was crucial. I'm not sure what I would have done if I had not come upon such a solution like this. I'm able to at this point relish my future. Thank you very much for your expert and result oriented guide. I will not hesitate to propose your blog to anybody who should have direction about this subject matter. stone island

yeezy boost said: I simply needed to thank you very much once again. I do not know what I could possibly have gone through in the absence of the entire aspects provided by you directly on my concern. It truly was a distressing crisis in my position, but taking note of this specialised form you treated it made me to cry with delight. Now i am grateful for your help and even hope that you realize what an amazing job you happen to be providing teaching men and women via your web blog. I'm certain you have never met any of us. yeezy boost

yeezys said: Thanks a lot for giving everyone an extraordinarily pleasant possiblity to read critical reviews from here. It really is so excellent and also full of fun for me and my office friends to visit your web site not less than three times in a week to read the new guides you will have. And of course, I'm just actually satisfied concerning the perfect hints served by you. Selected 4 tips in this posting are easily the most suitable we've ever had. yeezys
Back