Overview

This talk, delivered by Alicia Rojas at RailsConf 2025, explores the evolution, current state, and future trends of authentication in Ruby on Rails, especially focusing on the recent introduction of a built-in authentication generator in Rails 8. The session demystifies authentication, often considered a 'black box,' by examining its history, the specifics of the Rails 8 implementation, and modern approaches such as passwordless authentication and SSO/OAuth integrations.

Key Points

• Historical Context

  • Early web authentication used basic HTTP auth (username & password in headers), lacking sessions or persistent user data.
  • Over time, increasing complexity in web applications necessitated more advanced identity and permission management.
  • Differentiates authentication (proving identity) from authorization (what a user is allowed to do).
  • Early Rails apps managed sessions manually, followed by the emergence of gems like oath and the more popular Devise (2009), which provided modular, full-featured authentication but often became opaque to developers.

• Introduction of Rails 8 Authentication Generator

  • Rails 8 now includes a built-in authentication generator, offering a simple, extensible, and transparent baseline for authentication workflows.
  • The generator creates a user model using secure password hashing (has_secure_password), a session model, authentication concerns (helpers in ApplicationController), and basic password reset flows.
  • Unlike Devise, this solution avoids hidden magic and auto-generated controllers, encouraging learning and customization.
  • Promotes best practices: RESTful design, testability, and transparency. Minimal default views are included, with easy extensions for sign-up features.

• Modern Authentication Flows

  • Passwordless Authentication:
  • Discusses the widespread problem of password reuse and weak/forgotten passwords, supporting the move towards passwordless authentication.
  • Demonstrates integration of the no_password gem with Rails 8 authentication.
  • Explains how temporary login codes, salts, and short expiration times secure the flow against brute force and interception.
  • SSO (Single Sign-On) and OAuth:
  • Clarifies SSO (authentication across multiple services with a single identity provider) versus OAuth (authorization protocol for resource access).
  • Integration steps are shown (setting up OAuth clients, configuring routes/controllers) using Google as an identity provider, highlighting inherited security such as 2FA.
  • Emphasizes reduced liability (not storing passwords) and enhanced user experience.

• Future and Emerging Trends

  • Anticipates wider adoption of passkeys and WebAuthn.
  • Notes the increasing role of behavioral and biometric signals, moving authentication towards a spectrum rather than a binary state.
  • Recognizes client-side technologies and JavaScript as influencing authentication flows.

Illustrative Examples

• Anecdote: Comparing authentication/authorization to international border entry (passport = identity, visa/permissions = authorization).
• Demo: Implementation of passwordless and SSO flows in a demonstration Rails application.
• Personal Security Experience: Behavioral anomaly detected by Google triggering a 2FA re-authentication.

Conclusion and Takeaways

• Rails 8 provides a transparent and editable base for authentication, reducing dependence on 'black boxes.'
• Passwordless and SSO/OAuth authentication are becoming expected standards, intersecting with UX and product security concerns.
• Understanding and customizing authentication flows empowers developers to build secure, user-friendly applications.
• Authentication is evolving with shifting technology and user expectations, emphasizing flexibility, security, and user control.