Woodlander a weblog of interesting things

Securing Rails Login Credentials

In Code, Rails, Ruby on 8 October 2008 with no comments

For a while now, I’ve been using the following trick (or something close to it) to secure my login credentials in my Rails code.

require 'digest/sha1'
class AdminController < ActionController::Base
  before_filter :authenticate

  private
  def authenticate
    authenticate_or_request_with_http_basic do |username, password|
      Digest::SHA1.hexdigest(username) == 'e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4' and
      Digest::SHA1.hexdigest(password) == '4f50f366a3f474aaac57f48ea1dce13ab1af9e5e'
    end
  end
end

Where those two long strings of random digits are hexed versions of my username and password. I do this because I don’t want to put my login details in plain sight in my code — what if my laptop was stolen?

Anyway, here’s a better version which you can drop into your Rails app somewhere (I’m working on a plugin):

class ActionController::Base
  def authenticate_or_request_with_hexdigest(credentials)
    require 'digest/sha1' unless defined?(Digest::SHA1)

    authenticate_or_request_with_http_basic do |username, password|
      Digest::SHA1.hexdigest(username) == credentials[:username] and
      Digest::SHA1.hexdigest(password) == credentials[:password]
    end
  end
end

Use thus:

class AdminController < ApplicationController::Base
  before_filter :authenticate 

  private
  def authenticate
    authenticate_or_request_with_hexdigest(
      :username => 'e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4',
      :password => '4f50f366a3f474aaac57f48ea1dce13ab1af9e5e'
    )
  end
end

Of course, you have to hex those credentials manually (in IRB, for instance): but you only need to do that once. What do you think?

Creating URL-Friendly Strings with Ruby

In Code, Rails, Ruby on 29 September 2008 with no comments

This is from a project I’m working on at the moment. The scenario: you have a string — say Post#title — that you want to convert for use in a URL. Some would suggest a simple substitution of punctuation marks for hyphens, but that creates ugliness when “John’s New Car” gets transformed into “john-s-new-car”: not what we want.

So, slightly more subtle:

class String
  def to_url_slug
    self.downcase.gsub(/['"]+/, '').gsub(/[^a-z0-9]+/i, '-')
  end
end

The first gsub removes single and double quotes from a string; the second gsub replaces non alphanumeric characters with hyphens (if you don’t recognise them, those funny strings of characters are regular expressions) — note that ‘i’ modifier which tells the second regular expression to ignore case when matching.

"John's New Car".to_url_slug # johns-new-car
"A (Terrible) Mess".to_url_slug # a-terrible-mess