Authentication verifies who is making a request. The familiar form is a username and password, but passwords alone are a risky proof of identity: attackers can automate login attempts and test credentials leaked from other sites. Reused passwords make targeted wordlists far more effective than guessing every possible combination. section 8.1
A brute-force attack submits many username-and-password combinations and records successful logins. Attackers commonly use tools such as Hydra with leaked username and password lists, turning password reuse into a practical route to account compromise. Treat a successful login as a security boundary that needs stronger protection than credentials alone. section 8.1
Authentication and authorization solve different problems. OAuth lets a user grant a third-party application limited access to an API without disclosing the user’s password; the resulting access token can be revoked. OpenID Connect adds an identity layer to OAuth, returning a signed JWT with profile data such as an email address so the calling application can identify the user. section 8.3
A practical third-party sign-in flow is:
- Register the application with an identity provider and use its application access token for OAuth calls. section 8.3
- Send the user to the provider’s authentication page, where they sign in and grant the requested permission. section 8.3
- Receive identity data through OpenID Connect, reject a response missing required data such as an email address, then find or create the local user and sign them in. section 8.3
- Restrict sensitive actions, such as server-side requests to arbitrary URLs, to authenticated users and rate-limit potentially abusive behavior. section 14.3
Sign in with an identity provider
A “Log in with Facebook” link starts an OmniAuth authorization flow. Its callback reads the provider response, requires an email address, looks up the local user, signs in an existing user, and redirects new users to registration. This keeps the third-party application from handling the user’s provider password. section 8.3
def facebook_omniauth_callback
auth = request.env['omniauth.auth']
if auth.info.email.nil?
return redirect_to new_user_registration_url,
alert: 'Please grant access to your email address'
end
@user = User.find_for_oauth(auth)
if @user.persisted?
sign_in @user
redirect_to request.env['omniauth.origin'] || '/',
event: :authentication
else
redirect_to new_user_registration_url
end
end
The callback shows the decision points after provider authentication: require an email address, locate the local user, sign in a persisted account, or route a new account to registration. section 8.3
