Security: Authentication & Authorization http://flic.kr/p/9UQDPM Security: Authentication & Authorization

In the most general terms, what bad things does computer security aim to prevent?

In the most general terms, what bad things does computer security aim to prevent? Unauthorized access to data Unauthorized modification of data Unauthorized control

Two Key Security Concerns Authentication Who is the user? Authorization What is the user allowed to do/access?

What methods of authentication are there?

What methods of authentication are there? Passwords Biometrics SMS code Secret question USB key

Where should authentication/authorization go? Ye Olde Internet Browser Rails Router Controller View Model DB

Where should authentication/authorization go? Ye Olde Internet Browser Rails Router Controller View Model DB Around here!

Given stateless nature of HTTP, how to prevent user from re-authenticating with each HTTP request? Ye Olde Internet Browser Rails Router Controller View Model DB

Given stateless nature of HTTP, how to prevent user from re-authenticating with each HTTP request? Ye Olde Internet Browser Rails Router Controller View Model DB Sessions/Cookies

How Cookies Work From: http://en.wikipedia.org/wiki/HTTP_cookie

A session is a server-side object that stores “conversational state” Ye Olde Internet Browser Rails Router Controller View Model DB

How to do authorization?

Role-Based Access Control Taken from http://en.wikipedia.org/wiki/Role-based_access_control

Final Note About Authentication and Authorization in Rails Example time! See: https://github.com/sdflem/auth_skeleton Rails Tutorial (Hartl) does “by hand” Gems available as well Devise most popular?