# Very simple authenticatation

**URL:** <https://www.ruby-forum.com/t/very-simple-authenticatation/163351>\
**Category:** Rails\
**Created:** [March 19, 2009, 2:47pm UTC](https://www.ruby-forum.com/t/very-simple-authenticatation/163351 "2009-03-19T14:47:02Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![johnsonmlw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f05b48/32.png) [@johnsonmlw](https://www.ruby-forum.com/u/johnsonmlw)\
**Post date:** [March 19, 2009, 2:47pm UTC](https://www.ruby-forum.com/t/very-simple-authenticatation/163351/1 "2009-03-19T14:47:02Z")

</div>

Could someone help me with this. It _really_ only needs to be this  
simple. I don’t need user models or plugins etc.

I think it’s clear what I’d like (either admin or slt to  
authenticate), but it’s obviously flawed and lets any username  
password combination in!

def authenticateAdmin  
authenticate\_or\_request\_with\_http\_basic do |name, password|  
name == “admin” || “slt” && password == “admin” || “slt”  
end  
end

I’ve also tried:

def authenticateAdmin  
authenticate\_or\_request\_with\_http\_basic do |name, password|  
(name == “admin” && password == “admin”) || (name == “slt” &&  
password == “slt”)  
end  
end

Thanks.

---

<div class="post-metadata">

**Author:** ![johnsonmlw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f05b48/32.png) [@johnsonmlw](https://www.ruby-forum.com/u/johnsonmlw)\
**Post date:** [March 19, 2009, 4:27pm UTC](https://www.ruby-forum.com/t/very-simple-authenticatation/163351/2 "2009-03-19T16:27:53Z")

</div>

def authenticateAdmin  
authenticate\_or\_request\_with\_http\_basic do |name, password|  
name == “admin” || “slt” and password == “admin” || “slt”  
end  
end

Im pretty sure that should work. “and” is evaluated after && . They’re  
now equivalent - its a ruby thing.

If it still doesnt work:

def authenticateAdmin  
authenticate\_or\_request\_with\_http\_basic do |name, password|  
(name == “admin” || “slt”) and (password == “admin” || “slt”)  
end  
end

I hope I understood your question correctly. 😛

---

<div class="post-metadata">

**Author:** ![johnsonmlw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f05b48/32.png) [@johnsonmlw](https://www.ruby-forum.com/u/johnsonmlw)\
**Post date:** [March 19, 2009, 4:29pm UTC](https://www.ruby-forum.com/t/very-simple-authenticatation/163351/3 "2009-03-19T16:29:18Z")

</div>

“Not” equivalent. Not “now”.

I don’t understand how I manage to make those typos. It’s not like I  
forgot a letter or something - I actually use another word in place.  
Strange xD

---

<div class="post-metadata">

**Author:** ![johnsonmlw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f05b48/32.png) [@johnsonmlw](https://www.ruby-forum.com/u/johnsonmlw)\
**Post date:** [March 19, 2009, 10:07pm UTC](https://www.ruby-forum.com/t/very-simple-authenticatation/163351/4 "2009-03-19T22:07:40Z")

</div>

Thanks for the suggestion.

I get the same problem. _Any_ username or password is allowed.

So I can enter ‘foo’ and no password and it let’s me in.

Odd.

---

<div class="post-metadata">

**Author:** ![johnsonmlw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f05b48/32.png) [@johnsonmlw](https://www.ruby-forum.com/u/johnsonmlw)\
**Post date:** [March 19, 2009, 10:21pm UTC](https://www.ruby-forum.com/t/very-simple-authenticatation/163351/5 "2009-03-19T22:21:16Z")

</div>

johnsonmlw wrote:  
[…]

> I get the same problem. _Any_ username or password is allowed.
> 
> So I can enter ‘foo’ and no password and it let’s me in.
> 
> Odd.

Not odd at all. The problem is that == binds tighter than ||, so that

user == ‘admin’ || ‘slt’

is equivalent to

(user == ‘admin’) || ‘slt’

This will return true if user is ‘admin’, or ‘slt’ in any other case.  
It will never return false.

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![johnsonmlw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f05b48/32.png) [@johnsonmlw](https://www.ruby-forum.com/u/johnsonmlw)\
**Post date:** [March 19, 2009, 10:38pm UTC](https://www.ruby-forum.com/t/very-simple-authenticatation/163351/6 "2009-03-19T22:38:34Z")

</div>

johnsonmlw wrote:

> Thanks for the suggestion.
> 
> I get the same problem. _Any_ username or password is allowed.
> 
> So I can enter ‘foo’ and no password and it let’s me in.
> 
> Odd.

So basically…:

def authenticateAdmin  
authenticate\_or\_request\_with\_http\_basic do |name, password|  
true  
end  
end

?

I dont see how this can be useful to anyone though… But that might just  
be me. lol

---

<div class="post-metadata">

**Author:** ![johnsonmlw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f05b48/32.png) [@johnsonmlw](https://www.ruby-forum.com/u/johnsonmlw)\
**Post date:** [March 19, 2009, 10:24pm UTC](https://www.ruby-forum.com/t/very-simple-authenticatation/163351/7 "2009-03-19T22:24:43Z")

</div>

The logic is wrong. Try this:

def authenticateAdmin  
authenticate\_or\_request\_with\_http\_basic do |name, password|  
credentials = {‘admin’ =\> ‘admin’, ‘slt’ =\> ‘slt’}  
credentials[name] == pasword  
end  
end

On your previous examples, your method was returning ‘the last thing  
evaluated’ (a Ruby thing), and in your case, that happened to be  
‘slt’. ‘slt’, as a string, is not false, which is why your method was  
letting users in regardless of credentials.

Hardcoded credentials in any app are a terrible idea though…

---

<div class="post-metadata">

**Author:** ![johnsonmlw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f05b48/32.png) [@johnsonmlw](https://www.ruby-forum.com/u/johnsonmlw)\
**Post date:** [March 19, 2009, 10:43pm UTC](https://www.ruby-forum.com/t/very-simple-authenticatation/163351/8 "2009-03-19T22:43:17Z")

</div>

def authenticateAdmin  
authenticate\_or\_request\_with\_http\_basic do |name, password|  
[“admin”, “slt”].include?(name) and [“admin”,  
“slt”].include?(password)  
end  
end

Or the other way to interpret what you just said. Makes more sense 😛