Rack::SimpleAuth

Rack::SimpleAuth will contain different Authentication Class Middlewares

Until now only HMAC is implemented...

Installation

Add this line to your application's Gemfile:

gem 'rack-simple_auth'

And then execute:

$ bundle

Or install it yourself as:

$ gem install rack-simple_auth

Gem Status

Usage

HMAC Authorization

HMAC should be used for communication between website backend and api server/controller/whatever..

~~For usage between Server <-> Client a sniffer could easily extract the signature/public key and the encrypted message which is for now the same for the same request (see TODO implement timestamp).~~

~~With these 2 informations a "secure" backend could be easily seen public...~~

In version 0.0.5 the timestamp has been added to the msg which will be encrypted, also the possibility to configure the allowed delay a request can have has been added.

Uses Authorization HTTP Header, example: Authorization: MessageHash:Signature

Signature is the "Public Key"
MessageHash is the HMAC encrypted Message

Basic Usage:

config = {
  'GET' => 'path',
  'POST' => 'params',
  'DELETE' => 'path',
  'PUT' => 'path',
  'PATCH' => 'path'
  'tolerance' => 2,
  'signature' => 'signature',
  'secret' => 'secret',
  'logpath' => '/path/to/log/file'
}

map '/' do
  use Rack::SimpleAuth::HMAC, config
  run MyApplication
end

Note: Private Key and Signature should be served by a file which is not checked into git version control.

Config Hash

Via the config hash you are able to define the 'data' for each request method.
This data + HTTP Methodname is your Message what will be encrypted.

For example GET '/get/user?name=rack':

config = {
    .
    .
  'GET' => 'path'
    .
    .
 }

The Message what will be HMAC encrypted is:

message = { 'method' => 'GET', 'data' => '/get/user?name=rack' }.to_json

In Version 0.0.5 the timestamp has been added to the Message.

The new Message which will be encrypted looks like this:

message = { 'method' => 'GET', 'date' => Time.now.to_i +- delay range, 'data' => '/get/user?name=rack }.to_json

The tolerance which is configureable in the config hash sets the possible delay a request could have and still will be authorized.

Notice: For a set tolerance a Encrypted Message array will be generated and compared with the MessageHash from the AUTH Header

Logging

With config['logpath'] you can define a destination where the internal #log method should write to.

The Logging will only be triggered when a path is defined (leave config['logpath'] for disable logging) and a request is not authorized!

It contains following information:

HTTP_AUTHORIZATION Header
Config for the specific Request Method (GET => path etc ...)
The Encrypted Message Array which was expected
The Signature which was expected

TODO

~~Add Timestamp to encryption..~~

~~For now a sniffer could track a successfull request to the server and extract the HTTP_AUTHORIZATION HEADER for this request.~~

~~He got the encrypted message for the specific request && signature -> No security anymore...~~

Contributing

Fork it ( http://github.com/benny1992/rack-simple_auth/fork )
Create your feature branch (git checkout -b my-new-feature)
Commit your changes (git commit -am 'Add some feature')
Push to the branch (git push origin my-new-feature)
Create new Pull Request