1. Security: Authentication & Authorization
Security: Authentication & Authorization

2. In the most general terms, what bad things does computer security aim to prevent?

3. In the most general terms, what bad things does computer security aim to prevent?
Unauthorized access to data
Unauthorized modification of data
Unauthorized control

4. Two Key Security Concerns
Authentication
Who is the user?
Authorization
What is the user allowed to do/access?

5. What methods of authentication are there?

6. What methods of authentication are there?
Passwords
Biometrics
SMS code
Secret question
USB key

7. Where should authentication/authorization go?
Ye Olde Internet
Browser
Rails Router
Controller
View
Model DB

8. Where should authentication/authorization go?
Ye Olde Internet
Browser
Rails Router
Controller
View
Model DB
Around here!

9. Given stateless nature of HTTP, how to prevent user from re-authenticating with each HTTP request?
Ye Olde Internet
Browser
Rails Router
Controller
View
Model DB

10. Given stateless nature of HTTP, how to prevent user from re-authenticating with each HTTP request?
Ye Olde Internet
Browser
Rails Router
Controller
View
Model DB
Sessions/Cookies

11. How Cookies Work
From:

12. A session is a server-side object that stores “conversational state”
Ye Olde Internet
Browser
Rails Router
Controller
View
Model DB

13. How to do authorization?

14. Role-Based Access Control
Taken from

15. Final Note About Authentication and Authorization in Rails
Example time! See:
Rails Tutorial (Hartl) does “by hand”
Gems available as well
Devise most popular?