使用 Devise 实现更好的 Rails 身份验证，无需 SSL
我现在需要非常基本的身份验证方案，并且我不想在登录过程中涉及 SSL。然而，仅以纯文本形式发送密码感觉真的很蹩脚，所以我想半途而废。设计（或扩展）中是否有任何构建方式可以防止发送纯文本密码并使用某种哈希值代替？
顺便说一句：请不要因为 SSL 或此解决方案（缺乏）安全性而引发任何激烈的争论。我知道任何后果、解决方案的安全级别等等。我现在只需要以尽可能少的努力解决我的问题（我不想自己编写这部分代码）。
I need very basic authentication scheme for now and I don't want to involve SSL for the login process. However sending passwords just in plain text feels really lame, so I would like to meet half-way. Is there any build in way in devise (or extension), which prevents sending plain text password and uses some sort of hashes instead?
btw: Please don't start any flame war over SSL, or (lack of) security in this solution. I am aware of any consequences, security level of the solution and so. I just need a solution to my problem for now with the least effort possible (I don't want to code this part by myself).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
一种可能性是向用户的手机、电子邮件或 IM 帐户发送一个简单的一次性密码，尽管这会让您编写的代码超出您的预期。然后，用户可以回复该消息或单击一次性链接来获得访问权限。
它或多或少地消除了传统双因素身份验证的第一个因素。
One possibility, although it will leave you coding more than you'd probably like, is to send a simple one-use passcode to the user's cell phone, email, or IM account. The user can then reply to that or click on the one-time link to gain access.
It's more or less ripping out the first factor of traditional two-factor authentication.
我不确定您为什么对 SSL 不感兴趣，我相信您有自己的理由，但由于我看到您使用 Heroku，您始终可以启用 Piggyback SSL 插件，而无需为 SSL 支付额外费用。
除此之外，您可以考虑某种客户端哈希或加密/解密解决方案。我不知道任何 Rails 预先存在的东西，但我想到的是一个像 http://wordpress.org/extend/plugins/semisecure-login-for-25/ 或 http://wordpress.org/extend/plugins/semisecure-login-reimagined/ 使用对称密钥加密进行某种 diffie-hellman 来保护身份验证会话。
除此之外，如果你用谷歌搜索“rails 二因素身份验证”，还有几个适用于 Rails 的二因素身份验证插件。我自己还没有尝试过，但我有兴趣找个时间尝试一下付费的 Authfactor (http://www.binpress.com/app/authfactor/173) Rails 插件。
希望有帮助。
I'm not sure why your not interested in SSL, I'm sure you have your reasons, but since I see your using Heroku you could always enable the Piggyback SSL plugin without paying extra for SSL.
Other than that, you could consider some sort of client side hashing or encryption/decryption solution. I'm not aware of anything prexisting for rails, but what comes to mind is a wordpress plugin like http://wordpress.org/extend/plugins/semisecure-login-for-25/ or http://wordpress.org/extend/plugins/semisecure-login-reimagined/ to do a sort of diffie-hellman with symmetric key encryption to protect the authentication session.
Other than that there are several two factor authentication plugins for rails if you google "rails two factor authentication". I haven't tried it myself, but I'd be interested in trying out the paid Authfactor (http://www.binpress.com/app/authfactor/173) rails plugin sometime.
Hope that helps.