# User login and authentication **URL:** \ **Category:** Rails\ **Created:** [September 15, 2009, 12:27pm UTC](https://www.ruby-forum.com/t/user-login-and-authentication/175543 "2009-09-15T12:27:32Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![phibo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d6d6ee/32.png) [@phibo](https://www.ruby-forum.com/u/phibo)\ **Post date:** [September 15, 2009, 12:27pm UTC](https://www.ruby-forum.com/t/user-login-and-authentication/175543/1 "2009-09-15T12:27:32Z")
Being a rails newbie, I started to design our first rails-based webapp. This app should not only be used via browsers, but we also want to provide a (RESTful) api. I love the ‘convention over configuration’ paradigm, but am totally clueless on what to do when it comes to user authentication. Is there a THE rails-way of doing this? I found many excellent gems and plugins, such as AAA or thoughtbot’s clearance. However, I keep asking myself, why not just use HTTP (digest) authentication? I may be missing something, but why do big players such as Facebook implement their own (token- and secret-based) scheme? What are you guys using? What is your favorite gem/plugin for user auth? ---
**Author:** ![phibo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d6d6ee/32.png) [@phibo](https://www.ruby-forum.com/u/phibo)\ **Post date:** [September 15, 2009, 1:45pm UTC](https://www.ruby-forum.com/t/user-login-and-authentication/175543/2 "2009-09-15T13:45:27Z")
Here are my favorite two summary discussions along with a pointer to a general security site. For my work the distinction between authentication and authorization (user name and user role) is important. I use a combination of plugins and gems to fill my needs since I feel site security is one area of coding that clearly benefits from a large user base. [http://wiki.rubyonrails.org/howtos/authentication-authorization](http://wiki.rubyonrails.org/howtos/authentication-authorization) [http://www.vaporbase.com/postings/Authorization\_in\_Rails](http://www.vaporbase.com/postings/Authorization_in_Rails) > **[More secure Rails apps - Ruby on Rails Security Project](https://rorsecurity.info/)** > > All in one place: Updated guides about a growing number of Ruby on Rails security topics and all your questions answered. ---
**Author:** ![phibo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d6d6ee/32.png) [@phibo](https://www.ruby-forum.com/u/phibo)\ **Post date:** [September 15, 2009, 2:41pm UTC](https://www.ruby-forum.com/t/user-login-and-authentication/175543/3 "2009-09-15T14:41:39Z")
hi rick, thanks for the help, read the sites with great interest! for my project, we won’t need authorization, basic (but strong, i.e., bcrypt strong) authentication will do. do you use either of these tools? - Clearance - restful-authentication - Authlogic I can’t figure out which to use/try first by reading the resp. docs. cheers, phibo ---
**Author:** ![phibo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d6d6ee/32.png) [@phibo](https://www.ruby-forum.com/u/phibo)\ **Post date:** [September 15, 2009, 8:27pm UTC](https://www.ruby-forum.com/t/user-login-and-authentication/175543/4 "2009-09-15T20:27:01Z")
+1 for Authlogic (and if you want roles too try acl9) ---
**Author:** ![phibo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d6d6ee/32.png) [@phibo](https://www.ruby-forum.com/u/phibo)\ **Post date:** [September 15, 2009, 6:26pm UTC](https://www.ruby-forum.com/t/user-login-and-authentication/175543/5 "2009-09-15T18:26:24Z")
phibo wrote: > hi rick, > > thanks for the help, read the sites with great interest! for my > project, we won’t need authorization, basic (but strong, i.e., bcrypt > strong) authentication will do. do you use either of these tools? > > - Clearance > - restful-authentication > - Authlogic > > I can’t figure out which to use/try first by reading the resp. docs. I haven’t used Clearance, but based on my experience with the other two, I’d recommend Authlogic. > cheers, > phibo ## Best, Marnen Laibow-Koser [http://www.marnen.org](http://www.marnen.org) removed\_email\_address@domain.invalid ---
**Author:** ![phibo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d6d6ee/32.png) [@phibo](https://www.ruby-forum.com/u/phibo)\ **Post date:** [September 18, 2009, 12:01am UTC](https://www.ruby-forum.com/t/user-login-and-authentication/175543/6 "2009-09-18T00:01:19Z")
Hongli L. wrote a nice article about bcrypt, which might be helpful to you. ---
**Author:** ![phibo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/d6d6ee/32.png) [@phibo](https://www.ruby-forum.com/u/phibo)\ **Post date:** [September 18, 2009, 4:29am UTC](https://www.ruby-forum.com/t/user-login-and-authentication/175543/7 "2009-09-18T04:29:53Z")
heimdull wrote: > +1 for Authlogic (and if you want roles too try acl9) I’ve been using rails\_authorization for roles. I seem to recall that acl9 didn’t seem like much last time I looked at it, but I’ve been hearing enough about it that I may have to take another look. ## Best, Marnen Laibow-Koser [http://www.marnen.org](http://www.marnen.org) removed\_email\_address@domain.invalid