User Authentication with Rails and Backbone.js
42floors.com
User Authentication with Rails and Backbone.js
1–10 of 19 posts
Re: User Authentication with Rails and Backbone.js
#2Or just use devise. Backbone will work just fine with it.
Re: User Authentication with Rails and Backbone.js
#3You probably want attr_accessible in there.
Re: User Authentication with Rails and Backbone.js
#4One of the fundamental difficulties of handling login with Backbone.js is that your regular site is usually served off HTTP, but you want to send credentials via HTTPS, which requires various hacks, or a full page refresh. By posting up something that doesn't handle that problem, I'm afraid that the OP is putting a newbie who isn't aware of that problem in danger since they are apt to copy this tutorial verbatim.
Re: User Authentication with Rails and Backbone.js
#5Or just use devise. Backbone will work just fine with it.
Does Devise handle XHR and JSON (requests/responses) out of the box?
Re: User Authentication with Rails and Backbone.js
#6One of the fundamental difficulties of handling login with Backbone.js is that your regular site is usually served off HTTP, but you want to send credentials via HTTPS, which requires various hacks, or a full page refresh. By posting up something that doesn't handle that problem, I'm afraid that the OP is putting a newbie who isn't aware of that problem in danger since they are apt to copy this tutorial verbatim.
Thank you for pointing this out. As someone who hasn't explicitly tried out backbone.js yet but wanted to use it for a future project, this is something that was at the back of my mind.
Re: User Authentication with Rails and Backbone.js
#7Re: User Authentication with Rails and Backbone.js
#8One of the fundamental difficulties of handling login with Backbone.js is that your regular site is usually served off HTTP, but you want to send credentials via HTTPS, which requires various hacks, or a full page refresh. By posting up something that doesn't handle that problem, I'm afraid that the OP is putting a newbie who isn't aware of that problem in danger since they are apt to copy this tutorial verbatim.
Yes, this is true. I'll mention this in an update. When working in dev I've always just used regular HTTP. I'll mention how to configure Rails to use SSL.
Re: User Authentication with Rails and Backbone.js
#9One of the fundamental difficulties of handling login with Backbone.js is that your regular site is usually served off HTTP, but you want to send credentials via HTTPS, which requires various hacks, or a full page refresh. By posting up something that doesn't handle that problem, I'm afraid that the OP is putting a newbie who isn't aware of that problem in danger since they are apt to copy this tutorial verbatim.
What "various hacks" does submitting an HTTPS login form require?
For what it's worth, if you want real HTTPS security, you can't serve pages from your "regular site" over HTTP -- especially pages with a login form on them -- doing so is an invitation for a man in the middle to step in and phish your visitors.
Re: User Authentication with Rails and Backbone.js
#10One of the fundamental difficulties of handling login with Backbone.js is that your regular site is usually served off HTTP, but you want to send credentials via HTTPS, which requires various hacks, or a full page refresh. By posting up something that doesn't handle that problem, I'm afraid that the OP is putting a newbie who isn't aware of that problem in danger since they are apt to copy this tutorial verbatim.
What "various hacks" does submitting an HTTPS login form require? For what it's worth, if you want real HTTPS security, you can't serve pages from your "regular site" over HTTP -- especially pages with a login form on them -- doing so is an invitation for a man in the middle to step in and phish your visitors.
I do not mean submitting an HTTPS login form, which works just fine, but forces a full page refresh. I mean capturing a submit and sending the credentials via AJAX, but to HTTPS, which is forbidden by the security sandbox. You end up doing various unkosher things like bringing up the login form over HTTPS in an iframe while the site itself is brought up over HTTP.
Yes, this is fundamentally insecure, and I am aware that this is not a problem with Backbone specifically, but a general problem with the approach of building browser apps without page refreshes over HTTP for everything except for the login screen.