Unraveling the black box: past, present and future of authentication in Rails
summary
Built-in Rails 8 authentication generator scaffolds a readable login flow: user model with has_secure_password (bcrypt), session model and controller, authentication concern, password reset, and plain routes — no engines or magic. Passwordless demo uses the no password gem: server issues a six‑digit code plus a browser‑stored salt, default three attempts and five‑minute expiry. OAuth via Google uses client ID/secret and redirect URL; the demo works and honors the provider 2FA.
AI-written summary · about
chapters (8)
- 0:00Rails auth history
- 1:52Early web auth methods
- 4:04Rails auth gems evolution
- 7:42Rails 8 auth generator
- 11:38Passwordless auth
- 16:36SSO vs OAuth
- 20:08Key takeaways
- 23:40Closing
related talks
59mGoing Auth The Rails On A Crazy Train
20mBuilding a Resilient MFA Framework: Strategies and Best Practices
27mGo Auth Urself
57mSecurity and Identity: Ruby, CAS, and OpenID
31mRails Application Security in Practice
43mSecuring Your Site
39mNo passwords, no problem: move beyond passwords with webauthn and passkeys
28mWelcome to Authentication Hell