omniauth-onetime 1.0.3 → 1.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 02cd7168c669fb181e9ce83448b2511be1bef7f2
-  data.tar.gz: 7fef5ba2c59398e822b3cb9be38f5a597c1f7861
+  metadata.gz: 40834fd3d8b50476dadb4e1fb04acab0ff4a384e
+  data.tar.gz: 21f91f93bbb1c40cf8bdc38dea8450f236d71772
 SHA512:
-  metadata.gz: 9cccd68094ebf8a352b8580c6262eea38c9340717074ad1cf63fa1f5d7377c64645e71f1744b4ac9376fc0da4082b9d770f3777b7078e8095c511ecef2ae12f4
-  data.tar.gz: dd66672acc3118bf2ff80febfe0d2bfa2f29a987de06044ef8a4f2f82e3a5a1ca8ac272c3541c60f9c7d3143f40a7d4d3ad60bdfe5d66873e50b0b7f0e8b4bba
+  metadata.gz: a5d4809b47eee98df3b95322445d847bc3abb7b00901a710c8987e5414b6d66fc690dd4edc83c8bb1a8a0067f31faeab0666a7138d452b97c14d8d5cac1044df
+  data.tar.gz: d5f3e9eeadfa45f7b921f12017da747bccdaa2cf9f02826cf2046e2cddb04068e51228c419b1eca4e07bb717bdf8bc0649ef166adc4b1e086e4e942adbd1961d

data/.rubocop.yml

@@ -718,17 +718,17 @@ Style/LineEndConcatenation:
                  line end.
   Enabled: false
 
-Style/MethodCallParentheses:
+Style/MethodCallWithoutArgsParentheses:
   Description: 'Do not use parentheses for method calls with no arguments.'
   StyleGuide: 'https://github.com/bbatsov/ruby-style-guide#no-args-no-parens'
-  Enabled: false
+  Enabled: true
 
 Style/MethodDefParentheses:
   Description: >-
                  Checks if the method definitions have or don't have
                  parentheses.
   StyleGuide: 'https://github.com/bbatsov/ruby-style-guide#method-parens'
-  Enabled: false
+  Enabled: true
 
 Style/MethodName:
   Description: 'Use the configured style when naming methods.'

data/README.md

@@ -15,7 +15,7 @@ other password breaches every web development team needs to ask:
 
 **Is it worth storing long term user generated passwords?**
 
-I suggest that it very rarely is.
+I suggest that it very rarely is, unless you are an email provider or a financial institution.
 
 ## Vision
 
@@ -59,7 +59,7 @@ end
 `config/routes.rb` file something like this:
 
 ```ruby
-get '/auth/:provider/callback', to: 'sessions#create'
+post '/auth/:provider/callback', to: 'sessions#create'
 ```
 
 `app/controllers/sessions_controller.rb` file something like this:
@@ -117,10 +117,15 @@ These settings can be passed as a hash in the initializer.
 
 Reading List:
 
+* 2012-07-25: [Is it time for password-less login?](http://notes.xoxco.com/post/27999787765/is-it-time-for-password-less-login)
+* 2012-07-29: [More on password-less login](http://notes.xoxco.com/post/28288684632/more-on-password-less-login)
 * 2014-04-12: [Passwords are Obsolete](https://medium.com/@ninjudd/passwords-are-obsolete-9ed56d483eb)
 * 2014-10-15: [Passwordless authentication: Secure, simple, and fast to deploy](https://hacks.mozilla.org/2014/10/passwordless-authentication-secure-simple-and-fast-to-deploy/)
+* 2015-06-29: [Signing in to Medium by email](https://blog.medium.com/signing-in-to-medium-by-email-aacc21134fcd)
 * 2015-06-30: [Why passwords suck](https://medium.engineering/why-passwords-suck-d1d1f38c1bb4)
+* 2016-05-12: [Password-less hassle-free authentication in Rails](https://masa331.github.io/2016/05/21/passwordless-authentication-in-rails.html)
 * 2016-08-12: [Securing access to genetic and personal information without a password](https://biogeniq.ca/en/articles/securing-access-to-genetic-and-personal-information-without-a-password/)
+* 2016-10-20: [Password-Less Authentication in Rails](https://www.sitepoint.com/password-less-authentication-in-rails/)
 * [Passwordless](https://passwordless.net/)
 
 The nomenclature has been settling on calling this approach "passwordless".
@@ -134,9 +139,10 @@ transmission of quickly expiring one-time passwords.
 
 This approach may sound counter-intuitive, especially with a default password
 length of 8 characters. However, the real key to the security is that the
-passwords are sufficiently random and the window of opportunity is very short.
+passwords are sufficiently random and the window of opportunity to crack them
+is very short.
 A traditional username / password system fails because the passwords are not
-sufficiently random as truly random passwords are difficult to remember and
+sufficiently random, as truly random passwords are difficult to remember, and
 because the password lifetime is often very long. An issue which compounds
 these traditional systems is password reuse which puts accounts at risk
 whenever any system containing a user's password becomes compromised and
@@ -165,12 +171,13 @@ ends. See also: [xkcd: Password Reuse](https://xkcd.com/792/)
 ### Limitations:
 
 * A compromised email account will compromise the user account. **However, this
-is also true of any traditional password system that allows for email reset or
-recovery of passwords.** The only way to circumvent this attack vector is to
-handle password resets in a way that verifies a person's identity manually and
-likely in person and with identification. Since most websites are probably not
-willing to take that step (though financial institutions should be at the very
-least considering it) then emailed one-time passwords are just as secure as
+is also true of any traditional password system that allows for automated
+password reset or recovery via email.**
+The only way to circumvent this attack vector is to
+handle password resets in a way that verifies a person's identity manually,
+in person, and with identification. Since most websites are probably not
+willing to take that step (though financial institutions should at the very
+least consider it) then emailed one-time passwords are just as secure as
 any website employing an automated email password reset system.
 * Users must divulge an email account under their control to sign in. This does
 not seem like a huge hurdle. If people are concerned with their privacy they
@@ -214,6 +221,25 @@ It's probably wise to keep this in mind:
 
 [![xlcd: Security](http://imgs.xkcd.com/comics/security.png)](https://xkcd.com/538/)
 
+### Comparisons to similar solutions
+
+* [nopassword](https://github.com/alsmola/nopassword) -
+  I don't prefer this implementation: it's an engine, it's [very opinionated
+  about database structure](https://github.com/alsmola/nopassword/tree/master/db/migrate),
+  it always stores geographical location. I like OmniAuth because it allows
+  authentication mechanisms to be changed without requiring many, if any,
+  application changes. Storing geographic information may be something that
+  people want but I don't want to couple that with my solution.
+* [omniauth-passwordless](https://github.com/ultima51x/omniauth-passwordless) -
+  This does not appear maintained or developed and is not comparable - it simply
+  asks for an email address and passes that straight through - much like the
+  [OmniAuth Developer strategy](https://github.com/omniauth/omniauth/blob/master/lib/omniauth/strategies/developer.rb).
+  To quote from that code, "It has zero security and should *never* be used in a
+  production setting."
+* [omniauth-email](https://github.com/zshannon/omniauth-email) -
+  This does not appear maintained or developed. To quote the README, "this code
+  does not work, don't use it."
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/lib/omniauth/omniauth-onetime/version.rb

@@ -19,6 +19,6 @@
 #
 module OmniAuth
   module Onetime
-    VERSION = '1.0.3'.freeze
+    VERSION = '1.0.4'.freeze
   end
 end

data/lib/omniauth/strategies/onetime.rb

@@ -129,7 +129,7 @@ module OmniAuth
       end
 
       uid do
-        request.env['omniauth.params']['email']
+        request['email']
       end
 
       info do
@@ -148,6 +148,9 @@ module OmniAuth
           .deliver_now
       end
 
+      # if a password does not exist for the email, generate one, save it
+      # to the cache, then email it to the email address provided
+      # ie generate, save, send
       def prepare_password(email)
         # to prevent DOS do not send another password until previous one has
         # expired
@@ -161,7 +164,7 @@ module OmniAuth
       def request_email
         log :debug, 'STEP 1: Ask user for email'
 
-        form = OmniAuth::Form.new(title: 'User Info')
+        form = OmniAuth::Form.new(title: 'User Info', url: request_path)
         form.text_field :email, :email
         form.button 'Request Password'
         form.to_response
@@ -171,23 +174,13 @@ module OmniAuth
         log :debug, 'STEP 2: prepare password then ask user for password'
         prepare_password(email)
 
-        form = OmniAuth::Form.new(title: 'User Info')
+        form = OmniAuth::Form.new(title: 'User Info', url: callback_path)
         form.text_field :password, :password
         form.html("<input type=\"hidden\" name=\"email\" value=\"#{email}\">")
         form.button 'Sign In'
         form.to_response
       end
 
-      def request_verification(email, plaintext)
-        log :debug, 'STEP 3: verify password'
-        if verify_password(email, plaintext)
-          options[:password_cache].delete(email) # expire password
-          redirect callback_path
-        else
-          redirect request_path
-        end
-      end
-
       def request_phase
         email = request.params['email']
         plaintext = request.params['password']
@@ -197,9 +190,24 @@ module OmniAuth
         elsif plaintext.blank?
           request_password(email)
         else
-          request_verification(email, plaintext)
+          fail!(:took_a_wrong_turn)
+        end
+      end
+
+      def callback_phase
+        log :debug, 'STEP 3: verify password'
+        email = request.params['email']
+        plaintext = request.params['password']
+
+        if verify_password(email, plaintext)
+          # expire password
+          options[:password_cache].delete(email)
+          super
+        else
+          fail!(:invalid_credentials)
         end
       end
+
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-onetime
 version: !ruby/object:Gem::Version
-  version: 1.0.3
+  version: 1.0.4
 platform: ruby
 authors:
 - thoughtafter
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-12-16 00:00:00.000000000 Z
+date: 2017-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler