GithubHelp home page GithubHelp logo

robertomiranda / has_secure_token Goto Github PK

View Code? Open in Web Editor NEW
174.0 2.0 35.0 31 KB

Create uniques random tokens for any model in ruby on rails. Backport of ActiveRecord::SecureToken 5 to AR 3.x and 4.x

License: MIT License

Ruby 100.00%

has_secure_token's Introduction

Build Status Gem Version Dependency Status Code Climate

HasSecureToken

HasSecureToken provides an easy way to generate uniques random tokens for any model in ruby on rails. SecureRandom::base58 is used to generate the 24-character unique tokens, so collisions are highly unlikely.

Note If you're worried about possible collissions, there's a way to generate a race condition in the database in the same way that validates_uniqueness_of can. You're encouraged to add an unique index in the database to deal with this even more unlikely scenario.

Installation

Add this line to your application's Gemfile:

gem 'has_secure_token'

And then run:

$ bundle

Or install it yourself as:

$ gem install has_secure_token

Setting your Model

The first step is to generate a migration in order to add the token key field.

rails g migration AddTokenToUsers token:string
=>
   invoke  active_record
   create    db/migrate/20150424010931_add_token_to_users.rb

Then run rake db:migrate in order to update users table in the database. The next step is to add has_secure_token to the model:

# Schema: User(token:string, auth_token:string)
class User < ActiveRecord::Base
  has_secure_token
end

user = User.new
user.save
user.token # => "pX27zsMN2ViQKta1bGfLmVJE"
user.regenerate_token # => true

To use a custom column to store the token key field you can specify the column_name option. See example above (e.g: auth_token):

# Schema: User(token:string, auth_token:string)
class User < ActiveRecord::Base
  has_secure_token :auth_token
end

user = User.new
user.save
user.auth_token # => "pX27zsMN2ViQKta1bGfLmVJE"
user.regenerate_auth_token # => true

Running tests

Running

$ rake test

Should return

5 runs, 9 assertions, 0 failures, 0 errors, 0 skips

Contributing

  1. Fork it ( https://github.com/robertomiranda/has_secure_token/fork )
  2. Create your feature branch (git checkout -b my-new-feature)
  3. Commit your changes (git commit -am 'Add some feature')
  4. Push to the branch (git push origin my-new-feature)
  5. Create a new Pull Request

has_secure_token's People

Contributors

maksimabramchuk avatar marlonmantilla avatar pusewicz avatar rahij avatar robertomiranda avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar

has_secure_token's Issues

Is it possible to regenerate the token?

Hi, I wanna know if it's possible to create a new token. I saw the test file and there was a regenerate token function, can I use it like user.regenerate_token? thanks in advance

Security vulnerability from unhashed tokens?

Using this and rails console, this appears to be saving tokens directly in plain text in the database. Is there a way to have the migrations create a hashed digest column in the database instead?

I'm concerned because as I see it now we're simply matching plaintext strings.

Consider reading /dev/random instead of using SecureRandom

SecureRandom uses /dev/urandom which is non blocking (fantastic!), however when the entropy pool becomes small enough it becomes possible to guess the resulting number produced.

Reading /dev/random will be a much more secure way of generating this.

The only possible downside is that /dev/random is blocking

Add option so that token is not generated on create?

In my model I need to have an email confirmation token and a reset password token. Having the email confirmation token generated on creation is fine, but having it generated on creation for the reset password token is not required.

Maybe it would be nice to have an option so that when set, the token is not generated on create?

warnings on startup after upgrading to 5.2.3

I just upgraded to Rails 5.2.3 and Ruby 2.4.0 and get the following warnings when starting the server in development:

`/Users/me/.rvm/gems/ruby-2.4.0/gems/has_secure_token-1.0.0/lib/active_support/core_ext/securerandom.rb:4: warning: already initialized constant SecureRandom::BASE58_ALPHABET

/Users/me/.rvm/gems/ruby-2.4.0/gems/activesupport-5.2.3/lib/active_support/core_ext/securerandom.rb:6: warning: previous definition of BASE58_ALPHABET was here`

The warnings disappear when I remove 'has_secure_token' from my User.rb file.

specify which actions trigger token (re)generation?

I am building an app where I use to secure token as an API key, so this gem is great for generating an API key when the record is created, as well as the ability to re-generate the token.

However, if the record is merely edited, I do not want the token to be re-generated, as it currently seems to do. Would be nice to have an option to specify or exclude which actions trigger token re-generation?

Validations?

I've yet to check what upstream is doing, but would a before_validation hook be more appropriate than a before_create hook? Currently things like validates_presence_of :token don't work.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.