README.md in rack-simple_auth-0.0.4 vs README.md in rack-simple_auth-0.0.5

- old
+ new

@@ -23,15 +23,19 @@ [![Build Status](https://travis-ci.org/Benny1992/rack-simple_auth.png?branch=master)](https://travis-ci.org/Benny1992/rack-simple_auth) [![Coverage Status](https://coveralls.io/repos/Benny1992/rack-simple_auth/badge.png?branch=master)](https://coveralls.io/r/Benny1992/rack-simple_auth?branch=master) [![Gem Version](https://badge.fury.io/rb/rack-simple_auth.png)](http://badge.fury.io/rb/rack-simple_auth) [![Dependency Status](https://gemnasium.com/Benny1992/rack-simple_auth.png)](https://gemnasium.com/Benny1992/rack-simple_auth) + + + ## Usage ### HMAC Authorization HMAC should be used for communication between website backend and api server/controller/whatever.. + For usage between Server <-> Client a sniffer could easily extract the signature/public key and the encrypted message which is for now the same for the same request (see TODO implement timestamp). With these 2 informations a "secure" backend could be easily seen public... @@ -89,10 +93,11 @@ - HTTP_AUTHORIZATION Header - Config for the specific Request Method (GET => path etc ...) - The Encrypted Message which was expected - The Signature which was expected + ## TODO Add Timestamp to encryption.. For now a sniffer could track a successfull request to the server and extract the HTTP_AUTHORIZATION HEADER for this request. @@ -104,6 +109,10 @@ 1. Fork it ( http://github.com/benny1992/rack-simple_auth/fork ) 2. Create your feature branch (`git checkout -b my-new-feature`) 3. Commit your changes (`git commit -am 'Add some feature'`) 4. Push to the branch (`git push origin my-new-feature`) 5. Create new Pull Request + + + +