Add has_secure_token to Active Record #18217

robertomiranda · 2014-12-27T03:26:50Z

I take the audacity of include has_scure_token to Active Model since the implementation is using methods that are implemented in most of popular ORMs or ODMs in ruby, like exists?and save, is just as suggestion and for sure I'm open to move it to Active Record anyway 😄. Is still missing documentation but I'd like to hear first opinions about the implementation/code

Usage

class User < ActiveRecord::Base
  has_secure_token :token1, :token2, key_length: 30
end

user = User.new
user.save
user.token1 # => "973acd04bc627d6a0e31200b74e2236"
user.token2 # => "e2426a93718d1817a43abbaa8508223"
user.regenerate_token1! # => true
user.regenerate_token2! # => true

ref #16879

cc @dhh

simi · 2014-12-27T11:19:08Z

quoting @dhh from #16879 (comment):

Not interested in a heavily configurable thing. If someone wants to go hogwilld with that, it'll work great in a plugin. But for core, I'd just like something that works without configuration.

I think this introduces a lot of magic in contrast of has_secure_password implementation.

has_secure_password is all-in-one solution with 1 option only.

I think it is good idea to follow that simplicity so usecase will be:

class User < ActiveRecord::Base
  # add token column in migration
  has_secure_token
end

user = User.new
user.save
user.token # => "973acd04bc627d6a0e31200b74e2236"
user.regenerate_token! # => true

If this this simple solution is not enough for you, you'll need to roll your own then.

dhh · 2014-12-27T15:12:07Z

Allowing you to name the token being added or to have more than one does not qualify as "heavy configuration" in my book. I support both of those. What I wasn't interested in was configuration of the token itself. That should just work.

On Dec 27, 2014, at 03:19, Josef Šimánek notifications@github.com wrote:

quoting @dhh from #16879 (comment):

Not interested in a heavily configurable thing. If someone wants to go hogwilld with that, it'll work great in a plugin. But for core, I'd just like something that works without configuration.

I think this introduces a lot of magic in contrast of has_secure_password implementation.

has_secure_password is all-in-one solution with 1 option only.

I think it is good idea to follow that simplicity so usecase will be:

class User < ActiveRecord::Base

add token column in migration

has_secure_token
end

user = User.new
user.save
user.token # => "973acd04bc627d6a0e31200b74e2236"
user.regenerate_token! # => true
If this this simple solution is not enough for you, you'll need to roll your own then.

—
Reply to this email directly or view it on GitHub.

dhh · 2014-12-27T15:13:37Z

Although I do actually like the option of passing no options to has_secure_token and then having it default to a token name of "token".

On Dec 27, 2014, at 03:19, Josef Šimánek notifications@github.com wrote:

quoting @dhh from #16879 (comment):

Not interested in a heavily configurable thing. If someone wants to go hogwilld with that, it'll work great in a plugin. But for core, I'd just like something that works without configuration.

I think this introduces a lot of magic in contrast of has_secure_password implementation.

has_secure_password is all-in-one solution with 1 option only.

I think it is good idea to follow that simplicity so usecase will be:

class User < ActiveRecord::Base

add token column in migration

has_secure_token
end

user = User.new
user.save
user.token # => "973acd04bc627d6a0e31200b74e2236"
user.regenerate_token! # => true
If this this simple solution is not enough for you, you'll need to roll your own then.

—
Reply to this email directly or view it on GitHub.

dhh · 2014-12-27T15:15:59Z

Speaking of options. What justification are we using for key_length? Why would you want to change that number? Unless we have a very compelling reason, we should mix that.

On Dec 27, 2014, at 03:19, Josef Šimánek notifications@github.com wrote:

quoting @dhh from #16879 (comment):

Not interested in a heavily configurable thing. If someone wants to go hogwilld with that, it'll work great in a plugin. But for core, I'd just like something that works without configuration.

I think this introduces a lot of magic in contrast of has_secure_password implementation.

has_secure_password is all-in-one solution with 1 option only.

I think it is good idea to follow that simplicity so usecase will be:

class User < ActiveRecord::Base

add token column in migration

has_secure_token
end

user = User.new
user.save
user.token # => "973acd04bc627d6a0e31200b74e2236"
user.regenerate_token! # => true
If this this simple solution is not enough for you, you'll need to roll your own then.

—
Reply to this email directly or view it on GitHub.

matthewd · 2014-12-27T16:29:10Z

I don't think multiple tokens is such a common use case that we need to do a *names thing -- one per call seems fine, and gives us a simpler API to maintain compatibility with in future.

And as it's apparently necessary, I'll join the existing chorus: this needs to be part of ActiveRecord, not ActiveModel.

dhh · 2014-12-27T16:48:21Z

I’d be happy with it being one call per token. Don’t have a strong opinion on AR vs AM, but if others do, that’s fine.

On Dec 27, 2014, at 8:29 AM, Matthew Draper notifications@github.com wrote:

I don't think multiple tokens is such a common use case that we need to do a *names thing -- one per call seems fine, and gives us a simpler API to maintain compatibility with in future.

And as it's apparently necessary, I'll join the #16879 (comment) existing #16879 (comment) chorus #16879 (comment): this needs to be part of ActiveRecord, not ActiveModel.

—
Reply to this email directly or view it on GitHub #18217 (comment).

simi · 2014-12-27T16:49:08Z

I think this should be part of ActiveModel and just that part checking existing token should be part of ActiveRecord. It will be easy to integrate this into another ActiveModel based libraries like Mongoid.

dhh · 2014-12-27T16:50:16Z

activemodel/lib/active_model/secure_token.rb

+        # Load securerandom only when has_secure_key is used.
+        require 'securerandom'
+        include InstanceMethodsOnActivation
+        cattr_accessor :token_columns, :options


What's the token_columns variable for?

dhh · 2014-12-27T16:52:58Z

Actually, I'd say that as it was mentioned elsewhere, that this SecureRandom implementation is unlikely enough to generate a duplicate, then we don't need the #exists? check. Someone could just implement that as a column constraint or similar. Then this thing becomes even simpler and doesn't require any dependency on AR at all.

robertomiranda · 2014-12-27T17:02:40Z

@dhh 👍

dhh · 2014-12-27T17:11:55Z

I boiled this down to its essence:

module ActiveModel
  module SecureToken
    extend ActiveSupport::Concern

    module ClassMethods
      # Example using Active Record (which automatically includes ActiveModel::SecurePassword):
      #
      #   # Schema: User(auth_token:string, invitation_token:string)
      #   class User < ActiveRecord::Base
      #     has_secure_token :auth_token
      #     has_secure_token :invitation_token
      #   end
      #
      #   user = User.create
      #   user.auth_token # => "44539a6a59835a4ee9d7b112"
      #   user.invitation_token # => "226dd46af6be78953bde1648"
      #   user.regenerate_auth_token # => true
      #   user.regenerate_invitation_token # => true
      #
      # SecureRandom is used to generate the 24-character unique token, so collisions are highly unlikely.
      # But you're still encouraged to enforce uniqueness, if that's required, by something like a unique index
      # in the database or through a validation check.
      def has_secure_token(attribute)
        require 'securerandom'
        define_method("regenerate_#{attribute}") { update! attribute => SecureRandom.hex(12) }
        before_create { self[attribute] = SecureRandom.hex(12) }
      end
    end
  end
end

dhh · 2014-12-27T17:13:41Z

Sorry, that should be has_secure_token(attribute = 'token') to enable the default case as well.

simi · 2014-12-27T17:14:27Z

And I think it is better to call that regenerate method reset_token! .

@dhh 👍

dhh · 2014-12-27T17:15:46Z

We already use the word reset to signify returning an attribute to its original state after modification, so that won't work well.

dhh · 2014-12-27T17:20:18Z

Still on the fence about whether leaning exclusively on a unique index or the like to ensure no collisions is the right move here. The whole point is to make this as simple as possible. If it needs a db unique index to work, it loses a fair amount of that simplicity (even if the implantation obviously becomes much simpler).

dhh · 2014-12-27T17:27:09Z

Here's another stab at a version that includes collision checking/mitigation:

      def has_secure_token(attribute)
        require 'securerandom'
        define_method("regenerate_#{attribute}") { update! attribute => self.class.generate_unique_secure_token(attribute) }
        before_create { self[attribute] = self.class.generate_unique_secure_token(attribute) }
      end

      def generate_unique_secure_token(attribute)
        (1..10).detect { SecureRandom.hex(12) unless exists?(attribute => random_token) } ||
          raise "Couldn't generate a unique token in 10 attempts!"
      end

(All untested code that I just mocked out).

simi · 2014-12-27T18:16:37Z

I did a little experiment with SecureRandom.hex collision using https://gist.github.com/simi/d041f95d2e6a6b8ea2f7.

On Windows there wasn't collision in 100_000_000 iterations with 24 key length.
On Linux there wasn't collision in 10_000_000 iterations with 24 key length.
I reduced iterations on Linux since I owe a crappy linux machine.

But it is still random and collision can happen anytime. 😞

dhh · 2014-12-27T19:22:00Z

Yeah, I think we’ll just deal with it as proposed in the second code example I shared. This should be plug’n’forget.

On Dec 27, 2014, at 10:17 AM, Josef Šimánek notifications@github.com wrote:

I did a little experiment with SecureRandom.hex collision using https://gist.github.com/simi/d041f95d2e6a6b8ea2f7 https://gist.github.com/simi/d041f95d2e6a6b8ea2f7.

On Windows there wasn't collision in 100_000_000 iterations with 24 key length.
On Linux there wasn't collision in 10_000_000 iterations with 24 key length.
I reduced iterations on Linux since I owe a crappy linux machine.

But it is still random and collision can happen anytime.

—
Reply to this email directly or view it on GitHub #18217 (comment).

robertomiranda · 2014-12-27T20:30:44Z

Guys I moved this to AR and keeping guideline of the second @dhh's code example

robertomiranda · 2014-12-27T20:31:43Z

activerecord/lib/active_record/secure_token.rb

+          random_token = SecureRandom.hex(12)
+          return random_token unless exists?(attribute => random_token)
+        end
+        raise "Couldn't generate a unique token in 10 attempts!"


not sure if we should have a custom exception here wdyt?

something like raise CollisionLimitReached, "Couldn't generate a unique token in 10 attempts!"?

Don't think we need a custom exception. This is extremely unlikely to happen, so not something anyone would custom catch anyway.

I don't like this return / raise flow, though. What was wrong with the detect approach?

The issue with detect is that this methods finds the element on an enumerable, so basically in most of the cases will returns 1 or 2 instead of the token needed

maybe another approach more clear would be

10.times do if random_token = SecureRandom.hex(12) && exists?(attribute => random_token) raise "Couldn't generate a unique token in 10 attempts!" else return random_token end end

Ah, right, here's a variation that might work:

10.times do |i| SecureRandom.hex(12).tap do |token| if exists?(attribute => token) && i == 9 raise "Couldn't generate a unique token in 10 attempts!" else return token end end end

Don't love that the exceptional state is the first conditional, but ok.

This isn't right. This will raise an exception on the first collision. It's supposed to not raise an exception until the 10th time it still produces a collision.

On Dec 28, 2014, at 09:47, Roberto Miranda notifications@github.com wrote:

In activerecord/lib/active_record/secure_token.rb:

# user.save

# user.token # => "44539a6a59835a4ee9d7b112"

# user.regenerate_token # => true

def has_secure_token(attribute = :token)

# Load securerandom only when has_secure_key is used.

define_method("regenerate_#{attribute}") { update! attribute => self.class.generate_unique_secure_token(attribute) }

before_create { self.send("#{attribute}=", self.class.generate_unique_secure_token(attribute)) }

end

def generate_unique_secure_token(attribute)

require 'securerandom'

10.times do

random_token = SecureRandom.hex(12)

return random_token unless exists?(attribute => random_token)

end

raise "Couldn't generate a unique token in 10 attempts!"
Done

—
Reply to this email directly or view it on GitHub.

simi · 2014-12-28T18:08:49Z

activerecord/lib/active_record/secure_token.rb

+        10.times do |i|
+          SecureRandom.hex(12).tap do |token|
+            if exists?(attribute => token)
+              raise "Couldn't generate a unique token in 10 attempts!"


This can raise on every iteration.

What about?

raise "Couldn't generate a unique token in 10 attempts!" if i == 9

robertomiranda · 2014-12-28T20:08:20Z

activerecord/test/cases/secure_token_test.rb

+
+  def test_raise_and_exception_when_there_is_a_collision
+    User.stubs(:exists?).returns(true)
+    assert_raises(RuntimeError) do


fixed the issue of each iterations that raise an exception, but not sure with change this test is failing, seems to be everything covered. I was debugging into the test case code and 10.times only makes to iterations and is always returning 2 through the variable i, really weird

Not sure I understand? We should have a test case that covers exists? returning true, say, three times, and then returns false to cover the retry action.

I think you can use User.expects(:exists?).times(3).returns(true); User.expects(:exists?).returns(false) or something like that?

The real reason is described in https://github.com/rails/rails/pull/18217/files#r22300209.

robertomiranda · 2015-01-04T16:35:06Z

activerecord/test/cases/secure_token_test.rb

+    end
+  end
+
+  test "assing unique token after 9 attemps reached" do


@dhh: We still need another test case for "9 collisions, then a success = win" and "10 collisions exactly = fail" to test that the main loop is functioning as it should.

done!

dhh · 2015-01-04T17:07:06Z

This is looking good to me now 👍. I say we still want to do the base62 upgrade, but we can do that after merging.

robertomiranda · 2015-01-04T17:13:55Z

@dhh great, once this PR be already merged I'll open another one with base62 upgrade 👍

Add has_secure_token to Active Record

dhh · 2015-01-04T17:17:24Z

There you go :)

simi · 2015-01-04T17:17:51Z

👏

jonatack · 2015-01-05T14:19:29Z

🎉

aripollak · 2015-01-10T02:38:41Z

activerecord/lib/active_record/secure_token.rb

+      # validates_presence_of can. You're encouraged to add a unique index in the database to deal with
+      # this even more unlikely scenario.
+      def has_secure_token(attribute = :token)
+        # Load securerandom only when has_secure_key is used.


s/key/token/?

aripollak · 2015-01-10T02:44:25Z

It seems like @hundredwatt's comment wasn't addressed here. It seems weird to me to call something a secure token if it's stored in the database as plaintext, when the equivalent for passwords, has_secure_password, stores its value encrypted.

dhh · 2015-01-10T02:49:52Z

The security is in terms of its random generation. See SecureRandom.

On Jan 9, 2015, at 9:45 PM, Ari Pollak notifications@github.com wrote:

It seems like @hundredwatt https://github.com/hundredwatt's comment wasn't addressed here. It seems weird to me to call something a secure token if it's stored in the database as plaintext, when the equivalent for passwords, has_secure_password, stores its value encrypted.

—
Reply to this email directly or view it on GitHub #18217 (comment).

abscondite · 2016-02-08T23:54:42Z

activerecord/lib/active_record/secure_token.rb

+    module ClassMethods
+      # Example using has_secure_token
+      #
+      #   # Schema: User(toke:string, auth_token:string)


Fixed via #18537.

We don't need this gem anymore because the functionality has been added to Rails (by the author of the gem). rails/rails#18217 https://api.rubyonrails.org/classes/ActiveRecord/SecureToken/ClassMethods.html https://blog.bigbinary.com/2016/03/23/has-secure-token-to-generate-unique-random-token-in-rails-5.html Removing this gem will take care of the warning: already initialized constant SecureRandom::BASE58_ALPHABET Refs: #2430

* Remove has_secure_token gem We don't need this gem anymore because the functionality has been added to Rails (by the author of the gem). rails/rails#18217 https://api.rubyonrails.org/classes/ActiveRecord/SecureToken/ClassMethods.html https://blog.bigbinary.com/2016/03/23/has-secure-token-to-generate-unique-random-token-in-rails-5.html Removing this gem will take care of the warning: already initialized constant SecureRandom::BASE58_ALPHABET Refs: #2430 * Use BigDecimal instead of BigDecimal.new This will take care of the warning: BigDecimal.new is deprecated; use BigDecimal() method instead Refs: #2430

robertomiranda force-pushed the has_secure_token branch from ee740be to 6fb899e Compare December 27, 2014 03:32

dhh reviewed Dec 27, 2014
View reviewed changes

robertomiranda force-pushed the has_secure_token branch 2 times, most recently from 0236e04 to d4b91c6 Compare December 27, 2014 20:25

robertomiranda changed the title ~~Add has_secure_token to Active Model~~ Add has_secure_token to Active Record Dec 27, 2014

robertomiranda reviewed Dec 27, 2014
View reviewed changes

robertomiranda force-pushed the has_secure_token branch 2 times, most recently from e6c2d75 to a00f230 Compare December 28, 2014 17:46

simi reviewed Dec 28, 2014
View reviewed changes

robertomiranda force-pushed the has_secure_token branch from 6ad53c2 to 7296d96 Compare December 28, 2014 19:59

robertomiranda reviewed Dec 28, 2014
View reviewed changes

robertomiranda reviewed Jan 4, 2015
View reviewed changes

dhh pushed a commit that referenced this pull request Jan 4, 2015

Merge pull request #18217 from robertomiranda/has_secure_token

33a13c9

Add has_secure_token to Active Record

dhh merged commit 33a13c9 into rails:master Jan 4, 2015

matthewd mentioned this pull request Jan 5, 2015

Clean up secure_token_test #18344

Merged

robertomiranda mentioned this pull request Jan 5, 2015

Switching SecureTokens to Base58 #18347

Merged

aripollak reviewed Jan 10, 2015
View reviewed changes

robertomiranda mentioned this pull request Jan 11, 2015

Add has secure token to migration generator #18448

Merged

robertomiranda deleted the has_secure_token branch April 24, 2015 21:02

robertomiranda mentioned this pull request May 8, 2015

Consider reading /dev/random instead of using SecureRandom robertomiranda/has_secure_token#9

Closed

matthewd mentioned this pull request Sep 22, 2015

Flagging has_secure_token naming concern (like html_safe) #21716

Closed

rafaelfranca modified the milestones: 5.0.0 [temp], 5.0.0 Dec 30, 2015

abscondite reviewed Feb 8, 2016
View reviewed changes

HermanHiddema mentioned this pull request Mar 2, 2016

Use base 35 for generating secure tokens #24005

Closed

shaun-technovation mentioned this pull request Mar 17, 2020

Fix spec warnings Iridescent-CM/technovation-app#2430

Closed

diego-silva mentioned this pull request Jun 12, 2020

add has_secure_token to ActiveRecord::Base sorbet/sorbet-typed#267

Merged

gpeng mentioned this pull request Jan 6, 2021

[813] SPIKE Trainee slugs DFE-Digital/register-trainee-teachers#358

Closed

alexdesi mentioned this pull request Mar 4, 2021

Replace update_attributes with update per Rails 6.1 deprecation robertomiranda/has_secure_token#22

Closed

Add has_secure_token to Active Record #18217

Add has_secure_token to Active Record #18217

Conversation

robertomiranda commented Dec 27, 2014

simi commented Dec 27, 2014

dhh commented Dec 27, 2014

add token column in migration

dhh commented Dec 27, 2014

add token column in migration

dhh commented Dec 27, 2014

add token column in migration

matthewd commented Dec 27, 2014

dhh commented Dec 27, 2014

simi commented Dec 27, 2014

Choose a reason for hiding this comment

dhh commented Dec 27, 2014

robertomiranda commented Dec 27, 2014

dhh commented Dec 27, 2014

dhh commented Dec 27, 2014

simi commented Dec 27, 2014

dhh commented Dec 27, 2014

dhh commented Dec 27, 2014

dhh commented Dec 27, 2014

simi commented Dec 27, 2014

dhh commented Dec 27, 2014

robertomiranda commented Dec 27, 2014

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dhh commented Jan 4, 2015

robertomiranda commented Jan 4, 2015

dhh commented Jan 4, 2015

simi commented Jan 4, 2015

jonatack commented Jan 5, 2015

Choose a reason for hiding this comment

aripollak commented Jan 10, 2015

dhh commented Jan 10, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment