mikker/passwordless
Passwordless
Passwordless is an authentication engine for Ruby on Rails applications that replaces traditional password management with email-based magic link verification. It enables secure user access by generating and validating time-limited, cryptographically signed tokens, allowing users to authenticate through their email addresses.
The framework provides comprehensive session lifecycle management, including configurable expiration policies and route-based access control to protect sensitive application areas. It incorporates security primitives such as request rate limiting to mitigate brute force attacks and middleware to enforce authentication state across web requests.
Developers can customize the authentication flow by overriding default behaviors for session creation, page redirection, and notification delivery. The library also includes dedicated utilities for automated testing, allowing developers to programmatically simulate user sign-in and sign-out states within integration and system test suites.
Features
- Magic Link - Verifies user identity by sending time-limited magic links to email addresses to grant access without passwords.
- Session-Based Access Controls - Enforces route-level security by validating active user sessions and authentication state across web requests.
- Passwordless Authentication - Enables secure access to web applications by sending time-limited tokens to email addresses instead of requiring stored passwords.
- Middleware - Intercepts web requests to validate session state and enforce security policies before executing application logic.
- Rails Authentication Frameworks - Implements secure user login systems for Rails applications using email-based magic link verification.
- Brute Force Protections - Limits the frequency of authentication attempts to protect against automated guessing of magic link tokens.
- Authentication Rate Limiters - Limits the frequency of authentication attempts to mitigate brute force attacks and protect system resources.
- Route-Based Access Restrictions - Limits access to specific application paths based on authentication state using defined routing constraints.
- Database-Backed Session Authentications - Persists authentication tokens in a relational database to track validity and expiration status for every login attempt.
- Session Lifecycle Management - Defines custom expiration durations and timeout policies to manage the time windows during which users remain logged in.
- Session Token Issuance - Uses cryptographically signed tokens to verify user identity and establish persistent sessions without requiring stored passwords.
- Web Session Management - Controls user access and session lifecycles through configurable expiration policies and route-based constraints.
- Security Middleware - Includes utilities for managing session lifecycles, preventing brute force attacks, and restricting route access.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
