app/controllers/application_controller.rb
# Prevent CSRF attacks by raising an exception.
# For APIs, you may want to use :null_session instead.
Prevent CSRF attacks by raising an exception.
For APIs, you may want to use :null_session instead.
Prevent CSRF attacks by raising an exception . For APIs you may want to use : null_session instead .
def authenticate
    begin
      if session[:username].nil?
        @user = Amino::SecurityService.authenticate self
        unless @user.nil?
          session[:username] = @user.username
          session[:authorizations] = @user.authorizations
        end
      else
        @user = Amino::SecurityService.authenticate self
      end
      @amino_service = Amino::Client.get_amino_services(self)
    rescue SecurityError => e
      Rails.logger.warn e.inspect
      render(:file => File.join(Rails.root, 'public/403.html'), :status => 403, :layout => false)
    end
  end
def authenticate begin if session [ :username ] . nil? @user = Amino :: SecurityService . authenticate self unless @user . nil? session [ :username ] = @user . username session [ :authorizations ] = @user . authorizations end else @user = Amino :: SecurityService . authenticate self end @amino_service = Amino :: Client . get_amino_services ( self ) rescue SecurityError => e Rails . logger . warn e . inspect render ( :file => File . join ( Rails . root , 'public/403.html' ) , :status => 403 , :layout => false ) end end
Prevent CSRF attacks by raising an exception.
Prevent CSRF attacks by raising an exception .
# implementations of SecurityService#authenticate should: # a) return a User object if enough information is present to identify user # b) return nil if more information will be requested (basic auth, etc) # c) throw a SecurityError if user cannot be authenticated