-
Notifications
You must be signed in to change notification settings - Fork 31
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Replace confirmation_token with signed_id #20
Comments
After looking at Devise and Clearance I'm not sure if this is industry standard. Both of these gems use columns to store tokens used for confirmations and remembering the user. |
When I read the README, I also thought about using signed_id instead of the columns. I believe it is still possible. For user validation and password reset, the following requirements are essential. These requirements are also in the OWASP Forgot Password cheat sheet.
The default
As soon as something changes about the user, the token will invalidate, and the user needs to request a new one. You can also make this a bit more relaxed by only including the I still believe a message verifier is nicer to have than to include many |
A message verifier is also nice for the email update flow. You can use a message with the unconfirmed email address and send it to the user. When the user confirms with the message, you can update the database with the unconfirmed email address. And the remember token can also be replaced with a signed_id. |
@edwinv thank you for the detailed response! Maybe I'll create a different branch that uses signed ids to highlight this approach since I think this would be valuable. |
I could probably drop a lot of the tables and just use signed_id
The text was updated successfully, but these errors were encountered: