ruby 49 lines · 9 steps

Password resets with signed global IDs in Rails

A password reset flow that encodes the user in a signed, expiring token instead of storing reset records in the database.

Explained by highlit

Rails Intermediate authentication signed-tokens global-id security tokenless-flow

1class PasswordResetsController < ApplicationController
RESET_PURPOSE = :password_reset
RESET_EXPIRY = 15.minutes
4 
def create
  user = User.find_by(email: params[:email].to_s.downcase.strip)
7 
  if user
    sgid = user.to_sgid(expires_in: RESET_EXPIRY, for: RESET_PURPOSE)
    reset_url = edit_password_reset_url(token: sgid.to_s)
    UserMailer.with(user: user, reset_url: reset_url).password_reset.deliver_later
  end
13 
  redirect_to new_session_path, notice: "If that account exists, we've emailed a reset link."
end
16 
def edit
  @user = authenticated_user
  return if @user
20 
  redirect_to new_password_reset_path, alert: "That reset link is invalid or has expired."
end
23 
def update
  @user = authenticated_user
26 
  unless @user
    redirect_to new_password_reset_path, alert: "That reset link is invalid or has expired."
    return
  end
31 
  if @user.update(password_params)
    reset_session
    redirect_to new_session_path, notice: "Your password has been reset. Please sign in."
  else
    render :edit, status: :unprocessable_entity
  end
end
39 
private
41 
def authenticated_user
  GlobalID::Locator.locate_signed(params[:token], for: RESET_PURPOSE)
end
45 
def password_params
  params.require(:user).permit(:password, :password_confirmation)
end
49end

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1Signed global IDs let you carry a verified, expiring user reference in a URL without a database column.
2Returning the same generic response whether or not the account exists prevents user enumeration.
3Scoping tokens with a purpose stops a token minted for one action from being replayed for another.

Related explainers

ruby

require "shellwords"
require "open3"
 
module Backup

Building safe shell commands in Ruby

shell-out subprocess command-injection

Intermediate 7 steps

ruby

class UserAgentParser
  BROWSERS = [
    [/Edg\/([\d.]+)/, "Edge"],
    [/OPR\/([\d.]+)/, "Opera"],

Parsing user-agent strings in Ruby

regex pattern-matching lookup-tables

Intermediate 8 steps

python

import time
import uuid
 
from django.utils.deprecation import MiddlewareMixin

Attaching per-request context in Django

middleware request lifecycle multi-tenancy

Intermediate 7 steps

ruby

class LogAggregator
  BUCKET_FORMAT = "%Y-%m-%dT%H:%M"
 
  def initialize(entries)

Bucketing log entries by the minute in Ruby

aggregation hashing enumerable

Intermediate 5 steps

ruby

class WeeklySignupsReport
  DEFAULT_WEEKS = 12
 
  def initialize(weeks: DEFAULT_WEEKS, source: User.all)

Building a weekly signups report in Rails

service object aggregation group by

Intermediate 7 steps

ruby

class ApplicationController < ActionController::Base
  EXPERIMENTS = {
    checkout_button_color: %w[control blue green],
    onboarding_flow: %w[control streamlined]