Rails Authentication with OAuth 2.0 and OmniAuth

I am just saying that it makes more sense to present solutions (quick and easy solutions if possible) to the common problems, not the safest solutions. Of course, if my solution presented some serious vulnerability I would pinpoint it or rather stay away from it, but that’s not the case here.

The description of your app is “a simple app allowing users to authenticate via one of the presented social networks”. However, it is both doing this and allowing user to effectively register via the same mechanism. Where in your piece does it state that “anyone with a valid e-mail can authenticate”.

You are conflating authentication with account creation in your example. That’s fine, but your article should at least clearly state that.

Nowhere because it does not.

We can say the same about traditional login-password authentication - anyone with a valid e-mail can authenticate.

I did not mean to say that this app allows authenticating via e-mail. I just mean that allowing any user to authenticate (register) via his social network profile (what was done in this app) presents no more security risks that allowing anyone with a valid e-mail to authenticate (register) in some other app.

Yeah, maybe I should have pinpoint the fact that creating an account means authenticating as well, but this is clearly seen from the controller’s code. Will keep that thing in mind.

Hi there. First of all, thanks for this very useful post.
I have a question about getting the keys from the providers. For now, I’ll be creating it with the localhost:3000 URL as shown in this guide, but what do I have to do once I decide to deploy my app into production?

Thanks!

I’ve already answered by e-mail, however others might have this question as well: yes, you’ll have to do this :smile:

I’m monitoring discussions for my articles, so you don’t have to duplicate questions by e-mail. Cheers!

Actually, I’m looking for a recommendation for this + access control lists as described. Eg Given users who authenticate, some users can see some things some users can see others. If a user authenticates and they have a role, they gain access to the views defined in said role.

This post is awesome, and exactly what I needed up to that point :slight_smile: I want to prevent the case of ‘anyone getting access to everything’ and can’t seem to find a good answer.

Thank you! Well, here is my article on CanCan, an authorization solution for Rails http://www.sitepoint.com/cancancan-rails-authorization-dance/ I am also going to cover Pundit in some time. :smile:

Hi i am getting the error when google+ callback occurs

Type Error no implicit conversion of String into Integer

Please help me to out this error.Thannks

Sorry Solved this.Browser shows above error but console was showing that Google+ Api is not enable for your project. So i enabled that one.And Working fine.Thanks for simple and nice article.

Yeah, that was a crucial step. Thank you!

I was just wondering, what would I have to change in this to allow the users in my app to be able to sign in sign in/link all of the social networks to my app? This is so that when they press the share button on a post they will be able to share it to all of their social networks at one time

Well, that would be a bit more complex setup and unfortunately you’ll have to experiment yourself. The idea is to allow multiple authentications per user and just check that if he already logged in and logging in via another social network, just update his data in the appropriate field.

Hey, thank you for this nice tutorial. Now I’ve completed only up-to Twitter integration, and struck with a problem.

I run rails server inside Virtual Box with Ubuntu server guest. Hence to access rails app from host, I force rails server with this command “rails s -p 80 -b 192.168.x.xx”, So that in host browser entering just IP address will open my rails app and its working fine.
The problem is
In my Twitter app (https://apps.twitter.com/) I have given Website as “http://192.168.x.xx” and Callback URL as “http://192.168.x.xx/auth/twitter/callback”, but when I click twitter link from my app, Its showing error “OAuth::Unauthorized”. After I googled this issue, I found from StackOverflow that it happens when callback URL is wrongly specified. In this tutorial it is suggested to use “http://localhost:3000” which is not possible in my situation.

Any ideas?
Thank you.

Hi! What do these “x” stand for?

Hello bodrovis, I meant to show it was a dynamic IP and it keeps changing. “x” is a variable. Some times its 192.168.1.15, 192.168.1.18, 192.168.1.14 etc and it keeps changing each time I start Virtualbox. But I made sure that the current generated IP is same as the IP I have given in the twitter. And today I’ve to change the IP in twitter according to newly generated IP inside Ubuntu guest. What else I am missing?

Thank you.

Wait, if you are developing on your Ubuntu machine and interacting with your app from the same machine, you’ll have to provide 127.0.0.1 as an address.

Hey sorry, the problem was with this line “provider :twitter, ENV[‘TWITTER_KEY’], ENV[‘TWITTER_SECRET’]”.

As you have stated to copy paste Twitter key and secret, I did exactly same. But later found out that ENV[…] will search for environment variable set in the system. I found the solution after integrating Facebook login, with the error fb_id is not found. The solution was to either set environment variable for TWITTER_KEY and “T…_SECRET” or remove them and copy paste the key and secret as a string, withing double quotes (“sdfjk23424…”). I choose string method.

How ever now I have new problems now.

  1. Using Twitter I can login but I can’t logout. For some reason delete request is not being processed. I’m sure of integrating all code to app controller and user controller. Still working on it.

  2. And Facebook authentication happened up-to accepting app permissions. But soon after I accept it is showing me the error " :
    {“error”:{“message”:“Error validating client secret.”,“type”:“OAuthException”,“code”:1,“fbtrace_id”:“FNsnm7HwnE3”}}".
    Still digging on it.

  3. Google+ requires some thing other than basic IP addresses (192.168…) like http://localhost. So its not going to happen anytime soon. I have to map my rails server to no-ip free domain name.

  4. LinkedIn yet have to check. Anyways thank you for your support. I’m glad if you know solution to any of the above.

Yeah, I used ENV to hide my keys.

  1. If you use HTTP DELETE, then your link should be something like <%= link_to 'logout', '/logout', method: :delete %>. jquery_ujs adapter should be present on the page for this work, JS should be enabled in the browser.
  2. Have no idea what this means, maybe google can help :smile:
  3. Hrm, that’s interesting, I believe there should be away to test things our using private IP
  4. LinkedIn is the most painful I believe, so good luck :smile:

I have seen discussions pf problems with Facebook not sending an email address unless the account had permissions set to allow it.

Might that be the issue here?

No Mittineageue the problem was, while pasting I had left an inverted comma. So rails treated the app id as wrong. Now I can login with both FB and Twitter.