Ruby on Rails 中身份验证的最佳解决方案

Best Solution For Authentication in Ruby on Rails

提问by Dan Wolchonok

I'm looking for a pre-built solution I can use in my RoR application. I'm ideally looking for something similar to the ASP.NET Forms authentication that provides email validation, sign-up controls, and allows users to reset their passwords. Oh yeah, and easily allows me to pull the user that is currently logged into the application.

我正在寻找可以在我的 RoR 应用程序中使用的预构建解决方案。理想情况下，我正在寻找类似于 ASP.NET Forms 身份验证的东西，它提供电子邮件验证、注册控件并允许用户重置他们的密码。哦，是的，而且很容易让我拉出当前登录到应用程序的用户。

I've started to look into the already written pieces, but I've found it to be really confusing. I've looked at LoginGenerator, RestfulAuthentication, SaltedLoginGenerator, but there doesn't seem to be one place that has great tutorials or provide a comparison of them. If there's a site I just haven't discovered yet, or if there is a de-facto standard that most people use, I'd appreciate the helping hand.

我已经开始研究已经写好的文章，但我发现它真的很混乱。我看过 LoginGenerator、RestfulAuthentication、SaltedLoginGenerator，但似乎没有一个地方有很好的教程或提供它们的比较。如果有一个我还没有发现的网站，或者如果有大多数人使用的事实上的标准，我会很感激你的帮助。

采纳答案by Brian Armstrong

AuthLogic appears to be the new kid on the block and seems to be the next evolution of restful_authentication, easier to use, etc

AuthLogic 似乎是块上的新孩子，似乎是 restful_authentication 的下一个演变，更易于使用等

http://github.com/binarylogic/authlogic/tree/master

http://github.com/binarylogic/authlogic/tree/master

Edit: now that Rails 3 is out, Devise seems to be the new, new kid on the block

编辑：现在 Rails 3 出来了，Devise 似乎是这个街区的新孩子

https://github.com/plataformatec/deviseor I have been rolling my own authentication now with the has_secure_passwordbuilt in to Rails http://railscasts.com/episodes/250-authentication-from-scratch-revised

https://github.com/plataformatec/devise或者我现在一直has_secure_password在使用 Rails 内置的身份验证http://railscasts.com/episodes/250-authentication-from-scratch-revised

Side note: Ruby Toolbox is a great site for finding the current best solution in various categories (based on the number of GitHub watchers):

旁注：Ruby Toolbox 是一个很棒的站点，可以在各种类别中找到当前的最佳解决方案（基于 GitHub 观察者的数量）：

http://ruby-toolbox.com/categories/rails_authentication.html

http://ruby-toolbox.com/categories/rails_authentication.html

回答by John Topley

I would really recommend Restful Authentication. I think it's pretty much the de-facto standard.

我真的会推荐Restful Authentication。我认为这几乎是事实上的标准。

回答by Nick Hammond

For a really simple solution go with Clearance.

对于一个非常简单的解决方案，请使用Clearance。

If you are looking for more options Deviseis a great solution. It uses Warden which is a rack based authentication system.

如果您正在寻找更多选择，Devise是一个很好的解决方案。它使用 Warden，这是一种基于机架的身份验证系统。

回答by James A. Rosen

There's also RestfulOpenIDAuthenticationif you want OpenID support in addition to password support.

如果除了密码支持之外还需要 OpenID 支持，还有RestfulOpenIDAuthentication。

回答by pantulis

Just a note, LoginGenerator and SaltedLoginGenerator have been superseded by Restful Authentication and are unsupported on newer Rails releases -- dont waste any time on them, though they were great at the time.

请注意，LoginGenerator 和 SaltedLoginGenerator 已被 Restful Authentication 取代，并且在较新的 Rails 版本中不受支持——不要在它们上浪费任何时间，尽管它们当时很棒。

回答by Bryan M.

I'd also like to point out an excellent tutorial/discussionon extending the core functionality of Restful Authentication, in case you're looking for something a bit more robust.

我还想指出一个关于扩展 Restful Authentication 核心功能的优秀教程/讨论，以防您正在寻找更强大的东西。

回答by sarahhodne

AuthLogicseems to be what you want for this. It's very configurable, and although it doesn't generate the code for you, it's quite easy to use. For email validation and password recovery you probably want to use the :perishable_tokencolumn. AuthLogic takes care of it, you only need to reset it when it's used. For information on how to set up a basic app, you can take a look at Ryan Bates' Railscast on AuthLogic, and the "official" example app. Ben Johnson, the creator of AuthLogic has also written a blog post on how to RESTfully reset passwords.

AuthLogic似乎是您想要的。它是非常可配置的，虽然它不会为您生成代码，但它很容易使用。对于电子邮件验证和密码恢复，您可能希望使用该:perishable_token列。AuthLogic 会照顾它，您只需在使用时重置它。有关如何设置基本应用程序的信息，您可以查看 Ryan Bates在 AuthLogic 上的Railscast和“官方”示例应用程序。AuthLogic 的创建者 Ben Johnson 还撰写了一篇关于如何以 REST 方式重置密码的博客文章。

Unfortunately I can't post more than one link, but the links to the railscast, the password reset blog post and the example app are all in the README (see the AuthLogic repo for the README)

不幸的是，我不能发布多个链接，但 Railscast、密码重置博客文章和示例应用程序的链接都在自述文件中（请参阅自述文件的 AuthLogic 存储库）

Update: Now I can post more links, so I linked some more. Thank you marinatime for adding the link in the meanwhile

更新：现在我可以发布更多链接，所以我链接了更多。感谢 marinatime 同时添加链接

回答by sam

I'm really liking thoughtbot's clearance. Very simple and has a few good hooks and is testable.

我真的很喜欢思想机器人的通关。非常简单，有一些很好的钩子，是可测试的。

回答by domgblackwell

restful_authentication is a powerful tool which is very flexible and provides most of what you are looking for out of the box. However, a couple of caveats:

restful_authentication 是一个功能强大的工具，它非常灵活，提供了您正在寻找的大部分开箱即用的功能。但是，有几个警告：

1. Don't think in terms of 'controls'. In Rails the Model, View and Controller are much more independent than in 'Webforms-style' ASP.NET. Work out what you want from each layer independently, write tests/specs to match and make sure each layer is doing what you expect.
2. Even if you are using a plugin there is no substitute for reading (at least some) of the code generated. If you have a big-picture idea of what is going on under the hood, you will find debugging and customising much easier.

1. 不要考虑“控制”。在 Rails 中，模型、视图和控制器比在“Webforms 风格”的 ASP.NET 中更加独立。独立地从每一层中找出你想要的东西，编写测试/规范来匹配并确保每一层都在做你期望的事情。
2. 即使您正在使用插件，也无法替代阅读（至少部分）生成的代码。如果您对引擎盖下发生的事情有一个大局观，您会发现调试和自定义要容易得多。

回答by Evgeny

The plugin restful_authentication and other plugins that extend it, answer your needs perfectly. A quick search on github.com will reveal a lot of tutorials, examples, and extensitons. Just go here:
- http://github.com/search?q=restful_authentication

插件 restful_authentication 和其他扩展它的插件，完美满足您的需求。在 github.com 上快速搜索会发现很多教程、示例和扩展。去这里：
- http://github.com/search?q=restful_authentication

There are several projects that use restful_authentication just to provide examples of a bare-bones Rails app with just the authentication parts.

有几个项目使用 restful_authentication 只是为了提供仅包含身份验证部分的基本 Rails 应用程序示例。

1. http://github.com/fudgestudios/bort-- A base rails app featuring: RESTful Authentication
2. http://github.com/mrflip/restful_authentication_example-- Another project with a great examlpe of how to use restful_authentication
3. http://github.com/activefx/restful_authentication_tutorial-- Same as above, with some other plugins bundled.
4. http://railscasts.com/episodes/67-restful-authentication-- a great screencast explaining restful_authentication

1. http://github.com/fudgestudios/bort-- 一个基本的 Rails 应用程序，具有：RESTful 身份验证
2. http://github.com/mrflip/restful_authentication_example——另一个项目，其中包含了如何使用 restful_authentication 的一个很好的例子
3. http://github.com/activefx/restful_authentication_tutorial- 与上面相同，捆绑了一些其他插件。
4. http://railscasts.com/episodes/67-restful-authentication—— 一个解释 restful_authentication 的精彩截屏

This information should be enough to get you started finding heads and tails ... good luck.

这些信息应该足以让你开始寻找正面和反面……祝你好运。