baarkerlounger
/
two_factor_authentication
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Two factor authentication extension for Devise
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
199 Commits
3 Branches
13 Tags
466 KiB
Tree: 0f40c79bf2
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '0f40c79bf2'
${ noResults }
two_factor_authentication/lib/two_factor_authentication.rb

51 lines
1.5 KiB
Raw Normal View History Unescape

first commit
13 years ago
require 'two_factor_authentication/version'
require 'devise'
require 'active_support/concern'
Misc renames for otp secret key.
11 years ago
require "active_model"
Introducing first spec to test otp code.
11 years ago
require "active_record"
Misc renames for otp secret key.
11 years ago
require "active_support/core_ext/class/attribute_accessors"
require "cgi"
first commit
13 years ago
module Devise
mattr_accessor :max_login_attempts
@@max_login_attempts = 3
Allowing both config and override of allowed otp drift.
11 years ago
mattr_accessor :allowed_otp_drift_seconds
@@allowed_otp_drift_seconds = 30
Allows otp_length to be configurable Adds otp_length to options in README Sets default length to 6
10 years ago
mattr_accessor :otp_length
@@otp_length = 6
Add support for remembering a user's 2FA session in a cookie This makes the gem store a signed cookie for a configurable amount of time that allows the user to bypass 2FA. Our use-case for this is that we expire user’s Devise sessions after 12 hours, but don’t want to force them to authenticate using 2FA every day. Signed cookies are available since Rails 3. This requires the signing functionality to be properly configured, but is disabled by setting the config variable to `0`, the default.
9 years ago
Add support for directly delivered OTP codes Direct OTP codes are ones that are delivered directly to the user (e.g. SMS) via send_two_factor_authentication_code. These are randomly generated, short lived, and stored directly in the database. TOTP (and the rotp gem) is now only enabled for those user that have a shared secret (user.create_otp_secret).
9 years ago
mattr_accessor :direct_otp_length
@@direct_otp_length = 6
mattr_accessor :direct_otp_valid_for
@@direct_otp_valid_for = 5.minutes
Add support for remembering a user's 2FA session in a cookie This makes the gem store a signed cookie for a configurable amount of time that allows the user to bypass 2FA. Our use-case for this is that we expire user’s Devise sessions after 12 hours, but don’t want to force them to authenticate using 2FA every day. Signed cookies are available since Rails 3. This requires the signing functionality to be properly configured, but is disabled by setting the config variable to `0`, the default.
9 years ago
mattr_accessor :remember_otp_session_for_seconds
@@remember_otp_session_for_seconds = 0
Add support for OTP secret key encryption **Why**: To provide an additional layer of security. The TOTP spec (RFC 6238) recommends encrypting the keys. http://tools.ietf.org/html/rfc6238 **How**: Borrow the encryption code from the `attr_encrypted` gem and use it to encrypt and decrypt the `otp_secret_key` attribute. Allow users to add encryption by passing in `encrypted: true` to `has_one_time_password`. This provides backwards-compatibility for existing users of the gem. See the README updates for more detailed instructions for both new and existing users.
9 years ago
mattr_accessor :otp_secret_encryption_key
@@otp_secret_encryption_key = ''
Allow to customize value passed to 2fa remember cookie
8 years ago
mattr_accessor :second_factor_resource_id
@@second_factor_resource_id = 'id'
first commit
13 years ago
end
module TwoFactorAuthentication
Extract reused Warden key constant
11 years ago
NEED_AUTHENTICATION = 'need_two_factor_authentication'
Add support for remembering a user's 2FA session in a cookie This makes the gem store a signed cookie for a configurable amount of time that allows the user to bypass 2FA. Our use-case for this is that we expire user’s Devise sessions after 12 hours, but don’t want to force them to authenticate using 2FA every day. Signed cookies are available since Rails 3. This requires the signing functionality to be properly configured, but is disabled by setting the config variable to `0`, the default.
9 years ago
REMEMBER_TFA_COOKIE_NAME = "remember_tfa"
Extract reused Warden key constant
11 years ago
first commit
13 years ago
autoload :Schema, 'two_factor_authentication/schema'
module Controllers
autoload :Helpers, 'two_factor_authentication/controllers/helpers'
end
end
Devise.add_module :two_factor_authenticatable, :model => 'two_factor_authentication/models/two_factor_authenticatable', :controller => :two_factor_authentication, :route => :two_factor_authentication
require 'two_factor_authentication/orm/active_record'
require 'two_factor_authentication/routes'
require 'two_factor_authentication/models/two_factor_authenticatable'
require 'two_factor_authentication/rails'