当前位置：文江博客话题详情

检查用户是否获得授权（HTTP 基本身份验证，Rails 3.0.9）

发布于 2024-12-07 16:24:54 字数 84 浏览 0 评论 0原文

我正在使用 Rails 3.0.9 的 HTTP 基本身份验证，我需要检查用户是否有权显示我的 html.erb 文件中的某些元素。我怎样才能做到这一点？

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

清风无影 2024-12-14 16:24:54

Vitaly 的方法看起来是一个很好的解决方案，但有一个严重的错误，即向任何尝试登录的人授予管理员访问权限，即使他们的凭据不正确。（将此作为答案发布，希望它得到支持，并且人们不会盲目接受具有安全缺陷的“正确”答案）

首先，进行一些功能测试（针对需要身份验证的操作）：

test "admin is set with correct credentials" do
  @request.env['HTTP_AUTHORIZATION'] = ActionController::HttpAuthentication::Basic.encode_credentials("user", "pass")
  get :index
  assert_response 200
  assert_equal true, session[:admin]
end

test "admin isn't set with incorrect credentials" do
  @request.env['HTTP_AUTHORIZATION'] = ActionController::HttpAuthentication::Basic.encode_credentials("user", "incorrect")
  get :index
  assert_response 401
  assert_not_equal true, session[:admin]
end

如果您使用 Vitaly 的代码运行此测试，第二个测试失败，因为 session[:admin] 被设置为 true，即使密码不正确。

这是我的代码，用于正确设置 session[:admin] 并使两个测试都通过：

private
def authenticate
  authenticate_or_request_with_http_basic do |user_name, password|
    session[:admin] = (user_name == "name" && password == "pass")
  end
end

Vitaly's approach looks like a good solution, but has a serious bug that grants admin access to anyone who attempts to login, even if their credentials are incorrect. (Posting this as an answer in hopes that it gets upvoted and people don't blindly accept the "correct" answer with its security flaw)

First, a couple functional tests (on actions that require authentication):

test "admin is set with correct credentials" do
  @request.env['HTTP_AUTHORIZATION'] = ActionController::HttpAuthentication::Basic.encode_credentials("user", "pass")
  get :index
  assert_response 200
  assert_equal true, session[:admin]
end

test "admin isn't set with incorrect credentials" do
  @request.env['HTTP_AUTHORIZATION'] = ActionController::HttpAuthentication::Basic.encode_credentials("user", "incorrect")
  get :index
  assert_response 401
  assert_not_equal true, session[:admin]
end

If you run this with Vitaly's code, the second test fails because session[:admin] is being set to true, even though the password is incorrect.

Here's my code to properly set session[:admin] and make both tests pass:

private
def authenticate
  authenticate_or_request_with_http_basic do |user_name, password|
    session[:admin] = (user_name == "name" && password == "pass")
  end
end

回复收藏 0 原文