Class: AdminSuite::Auth::HttpBasic

Inherits:
Strategy
  • Object
show all
Defined in:
lib/admin_suite/auth/http_basic.rb

Overview

Built-in HTTP Basic authentication.

Credentials come from options or environment:

config.auth_strategy = :http_basic
config.auth_options  = { username: "...", password: "..." }

or ADMIN_SUITE_USERNAME / ADMIN_SUITE_PASSWORD.

Blank credentials deny every request — enabling the strategy without configuring credentials must never leave the admin open.

Defined Under Namespace

Classes: Actor

Instance Attribute Summary

Attributes inherited from Strategy

#options

Instance Method Summary collapse

Methods inherited from Strategy

#initialize

Constructor Details

This class inherits a constructor from AdminSuite::Auth::Strategy

Instance Method Details

#authenticate!(controller) ⇒ Object 



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/admin_suite/auth/http_basic.rb', line 20

def authenticate!(controller)
  username = options[:username].presence || ENV["ADMIN_SUITE_USERNAME"]
  password = options[:password].presence || ENV["ADMIN_SUITE_PASSWORD"]

  if username.blank? || password.blank?
    controller.render(
      plain: "AdminSuite: HTTP Basic auth is enabled but no credentials are configured. " \
             "Set ADMIN_SUITE_USERNAME and ADMIN_SUITE_PASSWORD (or config.auth_options).",
      status: :forbidden
    )
    return nil
  end

  authenticated = controller.authenticate_with_http_basic do |given_user, given_pass|
    # Single `&` (not `&&`) so both comparisons always run (constant time).
    ActiveSupport::SecurityUtils.secure_compare(given_user.to_s, username) &
      ActiveSupport::SecurityUtils.secure_compare(given_pass.to_s, password)
  end

  return Actor.new(username) if authenticated

  controller.request_http_basic_authentication("AdminSuite")
  nil
end