README.md in rack-simple_auth-0.0.4 vs README.md in rack-simple_auth-0.0.5
- old
+ new
@@ -23,15 +23,19 @@
[![Build Status](https://travis-ci.org/Benny1992/rack-simple_auth.png?branch=master)](https://travis-ci.org/Benny1992/rack-simple_auth)
[![Coverage Status](https://coveralls.io/repos/Benny1992/rack-simple_auth/badge.png?branch=master)](https://coveralls.io/r/Benny1992/rack-simple_auth?branch=master)
[![Gem Version](https://badge.fury.io/rb/rack-simple_auth.png)](http://badge.fury.io/rb/rack-simple_auth)
[![Dependency Status](https://gemnasium.com/Benny1992/rack-simple_auth.png)](https://gemnasium.com/Benny1992/rack-simple_auth)
+
+
+
## Usage
### HMAC Authorization
HMAC should be used for communication between website backend and api server/controller/whatever..
+
For usage between Server <-> Client a sniffer could easily extract the signature/public key and
the encrypted message which is for now the same for the same request (see TODO implement timestamp).
With these 2 informations a "secure" backend could be easily seen public...
@@ -89,10 +93,11 @@
- HTTP_AUTHORIZATION Header
- Config for the specific Request Method (GET => path etc ...)
- The Encrypted Message which was expected
- The Signature which was expected
+
## TODO
Add Timestamp to encryption..
For now a sniffer could track a successfull request to the server and extract the HTTP_AUTHORIZATION HEADER for this request.
@@ -104,6 +109,10 @@
1. Fork it ( http://github.com/benny1992/rack-simple_auth/fork )
2. Create your feature branch (`git checkout -b my-new-feature`)
3. Commit your changes (`git commit -am 'Add some feature'`)
4. Push to the branch (`git push origin my-new-feature`)
5. Create new Pull Request
+
+
+
+