README.md in fernet-1.6 vs README.md in fernet-2.0.rc1
- old
+ new
@@ -1,90 +1,70 @@
# Fernet
[![Build Status](https://secure.travis-ci.org/hgmnz/fernet.png)](http://travis-ci.org/hgmnz/fernet)
-[![Code Climate](https://codeclimate.com/badge.png)](https://codeclimate.com/github/hgmnz/fernet)
+[![Code Climate](https://codeclimate.com/github/hgmnz/fernet.png)](https://codeclimate.com/github/hgmnz/fernet)
Fernet allows you to easily generate and verify **HMAC based authentication
tokens** for issuing API requests between remote servers. It also **encrypts**
-data by default, so it can be used to transmit secure messages over the wire.
+the message so it can be used to transmit secure data over the wire.
![Fernet](http://f.cl.ly/items/2d0P3d26271O3p2v253u/photo.JPG)
Fernet is usually served as a *digestif* after a meal but may also be served
with coffee and espresso or mixed into coffee and espresso drinks.
Fernet about it!
## Installation
-Add this line to your application's Gemfile:
+Fernet is distributed as [a rubygem](https://rubygems.org/gems/fernet), so
+either add `gem 'fernet'` to your application's Gemfile or install it yourself
+by running `gem install fernet`.
- gem 'fernet'
-
-And then execute:
-
- $ bundle
-
-Or install it yourself as:
-
- $ gem install fernet
-
## Usage
Both server and client must share a secret.
You want to encode some data in the token as well, for example, an email
address can be used to verify it on the other end.
```ruby
-token = Fernet.generate(secret) do |generator|
- generator.data = { email: 'harold@heroku.com' }
-end
+token = Fernet.generate(secret, 'harold@heroku.com')
```
+
On the server side, the receiver can use this token to verify whether it's
legit:
```ruby
-verified = Fernet.verify(secret, token) do |verifier|
- verifier.data['email'] == 'harold@heroku.com'
+verifier = Fernet.verifier(secret, token)
+if verifier.valid?
+ operate_on(verifier.message) # the original, decrypted message
end
```
-The `verified` variable will be true if:
+The verifier is valid if:
-* The email encoded in the token data is `harold@heroku.com`
-* The token was generated in the last 60 seconds
+* The token was generated in the last 60 seconds (or some configurable TTL)
* The secret used to generate the token matches
Otherwise, `verified` will be false, and you should deny the request with an
HTTP 401, for example.
-The `Fernet.verify` method can be awkward if extracting the plain text data is
-required. For this case, a `verifier` can be requested that makes that
-use case more pleasent:
-
-```ruby
-verifier = Fernet.verifier(secret, token)
-if verifier.valid? # signature valid, TTL verified
- operate_on(verifier.data) # the original, decrypted data
-end
-```
-
The specs
([spec/fernet_spec.rb](https://github.com/hgmnz/fernet/blob/master/spec/fernet_spec.rb))
have more usage examples.
### Global configuration
-It's possible to configure fernet via the `Configuration` class. Put this in an initializer:
+It's possible to configure fernet via the `Configuration` class. To do so, put
+this in an initializer:
```ruby
# default values shown here
Fernet::Configuration.run do |config|
config.enforce_ttl = true
config.ttl = 60
- config.encrypt = true
end
```
### Generating a secret
@@ -92,16 +72,44 @@
generate it using `/dev/random` in a *nix. To generate a base64-encoded 256 bit
(32 byte) random sequence, try:
dd if=/dev/urandom bs=32 count=1 2>/dev/null | openssl base64
+### Ruby Compatibility
+
+Fernet is compatible with Ruby 1.9 and above. It is tested on the rubies
+available on this [Travis CI configuration
+file](https://github.com/hgmnz/fernet/blob/master/.travis.yml)
+
### Attribution
This library was largely made possible by [Mr. Tom
-Maher](http://twitter.com/#tmaher), who clearly articulated the mechanics
+Maher](https://twitter.com/tmaher), who clearly articulated the mechanics
behind this process, and further found ways to make it
[more](https://github.com/hgmnz/fernet/commit/2bf0b4a66b49ef3fc92ef50708a2c8b401950fc2)
[secure](https://github.com/hgmnz/fernet/commit/051161d0afb0b41480734d84bc824bdbc7f9c563).
+
+Similarly, [Mr. Keith Rarick](https://twitter.com/krarick) who implemented a [Go
+version](https://github.com/kr/fernet) and put together the [Fernet
+spec](https://github.com/kr/fernet-spec) which is used by this project to
+verify interoparability.
+
+### Contributing
+
+Contributions are welcome via github pull requests.
+
+To run the test suite:
+
+* Clone the project
+* Init submodules with `git submodule init && git submodule update`
+* Run the suite: `bundle exec rspec spec`
+
+Thanks to all [contributors](https://github.com/hgmnz/fernet/contributors).
+
+### Security disclosures
+
+If you find a security issue with Fernet, please report it by emailing
+the fernet security list: fernet-secure@googlegroups.com
## License
Fernet is copyright (c) Harold Giménez and is released under the terms of the
MIT License found in the LICENSE file.