# Authlogic and Restful Authentication - Security Issues

**URL:** <https://www.ruby-forum.com/t/authlogic-and-restful-authentication-security-issues/178775>\
**Category:** Rails\
**Created:** [November 11, 2009, 4:27am UTC](https://www.ruby-forum.com/t/authlogic-and-restful-authentication-security-issues/178775 "2009-11-11T04:27:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Katherine](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f9ae1b/32.png) [@Katherine](https://www.ruby-forum.com/u/Katherine)\
**Post date:** [November 11, 2009, 4:27am UTC](https://www.ruby-forum.com/t/authlogic-and-restful-authentication-security-issues/178775/1 "2009-11-11T04:27:52Z")

</div>

Greetings. I need to know an expert’s opinion on Authlogic and Restful  
Authentication as to security.  
I have used both and I personally like Authlogic precisely because it  
is more flexible.

As to security I am not aware of any risk as long as the authlogic  
examples are followed. However I need to know why certain developers  
feel that using Authlogic imposes security risks.

It’s like some manager tells you “your application is not secure  
because you are using authlogic” without clearly explaining why.

---

<div class="post-metadata">

**Author:** ![Katherine](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f9ae1b/32.png) [@Katherine](https://www.ruby-forum.com/u/Katherine)\
**Post date:** [November 11, 2009, 9:21am UTC](https://www.ruby-forum.com/t/authlogic-and-restful-authentication-security-issues/178775/2 "2009-11-11T09:21:39Z")

</div>

On Wed, Nov 11, 2009 at 4:25 AM, Katherine [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> It’s like some manager tells you “your application is not secure  
> because you are using authlogic” without clearly explaining why.

If there’s no explanation on that opinions, then you cannot take them  
seriously.  
Security depends on the developer, and several times on the user  
himself. How you cover your back it’s up to you regardless the  
plugin/gem you’re using, these are only tools that make the work a bit  
easier for you.  
When somebody tell you that your application is insecure for using  
some plugin, make him/her explain why and see if you have that  
covered, otherwise, nevermind it, if they can’t explain why, then  
that’s not even an advice.

Cheers.

–  
Leonardo M…  
There’s no place like ~

---

<div class="post-metadata">

**Author:** ![Katherine](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f9ae1b/32.png) [@Katherine](https://www.ruby-forum.com/u/Katherine)\
**Post date:** [November 11, 2009, 10:34am UTC](https://www.ruby-forum.com/t/authlogic-and-restful-authentication-security-issues/178775/3 "2009-11-11T10:34:15Z")

</div>

Thanks for your response.  
Security issue is something rather objective. I am still investigating  
why they say so (before I even ask or throw them that question).

---

<div class="post-metadata">

**Author:** ![Katherine](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f9ae1b/32.png) [@Katherine](https://www.ruby-forum.com/u/Katherine)\
**Post date:** [November 11, 2009, 3:36pm UTC](https://www.ruby-forum.com/t/authlogic-and-restful-authentication-security-issues/178775/4 "2009-11-11T15:36:05Z")

</div>

Katherine wrote:  
[…]

> As to security I am not aware of any risk as long as the authlogic  
> examples are followed. However I need to know why certain developers  
> feel that using Authlogic imposes security risks.

I’ve never heard this.

> It’s like some manager tells you “your application is not secure  
> because you are using authlogic” without clearly explaining why.

Well, _make_ them explain! They can’t just tell you the sky is green  
without taking you to the window and showing you, now can they?

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid