DEV Community: Scott Robertson

Easy has_secure_password Rails API Authentication

Scott Robertson — Fri, 22 Jan 2021 00:02:59 +0000

I had a very simple API I needed to build, to be consumed by a Nuxt.js application. This sent me down a path of trying to find a simple way to authenticate against an API, using an email/password.

// Detect dark theme var iframe = document.getElementById('tweet-1350422471380529152-367'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=1350422471380529152&theme=dark" }

However, as I tried more gems and libraries, I quickly found that they were one of the following:

Way over complex
Broken
And/or unmaintained

After speaking with @marcqualie about this, I discovered that he needed something similar. So we decided to quickly put together a library that we could use in our projects.

Introducing Tokenable:

tokenable / tokenable-ruby

Tokenable is a Rails gem that allows API-only applications a way to authenticate users. This can be helpful when building Single Page Applications, or Mobile Applications. Works with Devise, Sorcery, has_secure_password, and any other auth system you may want to use.

Tokenable

Tokenable is a Rails gem that allows API-only applications a way to authenticate users. This can be helpful when building Single Page Applications, or Mobile Applications. It's designed to work with the auth system you are already using, such as Devise, Sorcery and has_secure_password. You can also use it with any custom auth systems.

Simply send a login request to the authentication endpoint, and Tokenable will return a token. This token can then be used to access your API, and any authenticated endpoints.

Installation

Add this line to your application's Gemfile:

gem 'tokenable-ruby'

And then execute:

bundle install

Usage

Once you have the gem installed, lets get it setup:

rails generate tokenable:install User --strategy=devise

We make it easier for you, by adding out of the box support for some auth libraries. You can pick from the following options for --strategy, or leave it empty for a custom…

View on GitHub

Tokenable is a Rails gem that allows API-only applications a way to authenticate users. This can be helpful when building Single Page Applications, or Mobile Applications.

Setting it up with your existing auth system is simple, and using it from a JavaScript application, or mobile application is even more simple.

Once it's set up, all you need to do is send an email/password to the endpoint we provide you, and it will return a JWT token. This token can then be used to authenticate all future API calls.

Here is an example in Axios:

const { data } = await axios.post("https://example.com/api/auth", {
  email: "email@example.com",
  password: "coolpassword123",
});

const token = data.data.token;
const user_id = data.data.user_id;

You then use this token in all future API requests:

const { data } = await axios.get(`https://example.com/api/user/${user_id}`, {
  headers: { Authorization: `Bearer ${token}` },
});

Tokenable also supports Devise and Sorcery out of the box, but it can work with any auth system (or no auth system at all).

Let us know any feedback you have, and feel free to submit any issues you face.

How long did you live at that address?

Scott Robertson — Sun, 19 Mar 2017 01:22:25 +0000

How long did you live at that address?

A simple question you answer multiple times a year when applying for anything that requires a credit check. Yet it's a question I literally never know the answer to.

To solve this issue, I created a little web app to keep track of all my important dates.

It's very simple. It keeps track of the date an event happened, and how long that event lasted for. It also tells you how long ago the event was.

You can download and deploy the app on Github

Essential Travel Apps

Scott Robertson — Sun, 19 Feb 2017 18:47:26 +0000

As some of you may be aware, Libby and I recently spent 2 months travelling around Europe. Below are a number of apps that we could not have lived without during that time.

Moovit

When arriving a strange city for the first time, after hours of travelling, the first thing you want to do is get to your hotel. Navigating around a city can be difficult, especially when Uber is not an option. Moovit fills this gap by providing a comprehensive public transit guide.

Moovit allows you to select a destination, and it will provide all the information you need. All the transport options (buses, trains, metros etc), along with the timetables (in some cities, it provides real-time information), and most importantly "Get Off Alerts". These alerts will tell you when your stop is coming up, and when to get off. They are especially useful in countries that you do not speak the language, as it's very easy to misread bus stops etc.

Monzo

One of the most expensive aspects of travelling is something that most people don't even know exists, and that is currency exchange rates. You either head to the exchange shop or use your bank card. Both of which may offer "no fee" exchange rates, but what they fail to mention is that they are adjusting the exchange rate so that they make a profit from that.

Monzo is a startup, whose goal is to build a better bank. As part of their service, they offer no fee, mid-market exchange rates. This means that you are getting the best possible exchange rate available at that time.

Using the app, we were able to top up our Monzo accounts as we travelled, and we could use our bank cards as we normally would back home (unless you are in Germany, but that is a rant for another day).

Having a real time balance is also super useful as you can easily lose track of how much you are spending when a coffee costs 1500 Hungarian Forint.

Uber

Everyone knows what Uber is, so there is no need for me to explain this one.

One thing I will note though is that Uber charges you in the local currency, so it's very important to pair it with something like Monzo, which will negate any exchange rate charges.

Kayak Trips

Kayak is known for its website that allows you to buy plane tickets, book hotels, and rent cars. However, they have another product called Kayak Trips.

Trips is essentially a travel assistant. It saves all of your bookings, flights, and activities. Having all of this in 1 place is very useful when you are moving from one city to another every 4 days!

Not only does it store all of this information, but you also get real-time alerts for events such as flight delays and gate information.

There are a few alternatives to Kayak Trips out there such as TripIt, which is also very good, but I found Kayak Trips to be perfect for us.

Google Translate

To be honest, there were very few times that we actually needed this app, as the vast majority of European countries speak very good English.

However, on the odd occasion that we did use the app, it was normally using the Camera Mode. This allows you to point your phone at some text, and it will instantly translate it. This is especially useful for menus, or directions (when Moovit is not available).

Google Photos

This is one of those apps that you are not thankful for until you really need it. While travelling, like me, I am sure you take hundreds of photos.

Google Photos allows you to backup all of these photos up, not only allowing you to keep them safe, but it means that you can clean up your phone/camera to allow you to take lots more!

You can either choose to store photos in their original format, or in Google's compressed format. The latter does not count towards your storage limits, and while I have found that the quality is still very good, I still prefer to store the original, especially when the photos are not from a phone.

Three (Feel at Home)

Although not an app, I thought I would mention Three's Feel at Home service.

Well, thank you Three https://t.co/JjIkePXC9Q pic.twitter.com/LV5u3QO4TO

— Scott Robertson (@scottymeuk) 7 November 2016

Feel at Home allows you to use your phone as normal in multiple countries around the world, at no extra cost. Because I have unlimited data, this meant that I did not need to worry about using my phone when I needed it.

There are a few limitations in this service, but they generally don't get in the way. You are not able to tether, and while you can get 3G, all of the traffic is routed through the UK so it can feel a bit sluggish at points.

But as you can see, it saved me a lot of money and stress, so it's totally worth it.

If you have any suggested apps, then let me know.

Plex for Chromecast

Scott Robertson — Sun, 19 Jan 2014 12:00:00 +0000

When Plex announced that it would be an official Chromecast partner, I knew that I had to get ahold of one. On Christmas day, I jumped onto Amazon and ordered one for £35.

I had been using Plex for about 4 month before this, however I only had access to a very limited set of features due to using it as a DLNA device. I could browse the media (thumbnail and title) and play, and that was about it.

Getting the Chromecast has unlocked a lot more features that have made watching TV shows and Movies a whole lot nicer.

For example, I use trakt.tv extensively, and with a simple plugin, Plex automatically sends what I am watching to Trakt. This means I can keep track of what I am watching, and even tell Plex to filter only "Unwatched" episodes/movies. This now works with stuff I watch on my TV thanks to their Chromecast support, so I no longer have to worry about marking things as watched manually with an app.

Another great advantage is being able to control your TV with basically any device in the house. I can pick my Mac up, choose a TV show and start watching, and then pick my phone up and turn the volume down on the TV. This makes everything seamless and much nicer to use.

Because it's all going through Plex, it also means that I could stop watching something halfway through, and pick up where I left off on my phone. For example, I could watch QI on the way home on the Metro, and finish watching an episode on my TV using Chromecast when I got in.

If you use Plex and have not yet got a Chromecast, then I really recommend it. It has made watching media a lot nicer experience overall. And if you do not use Plex, then try it out!

Let me know how you get on in the comments.

Pushover

Scott Robertson — Thu, 10 Oct 2013 12:00:00 +0000

About 2 month ago, I found a nice service going by the name of pushover.net.

Pushover makes it easy to send real-time notifications to your Android and iOS devices.

I had a look around for a decent PHP library, but could not find one. Most of them either had way too much code for such a simple task (it's basically a curl call), or where totally untested.

The library I built is very easy to use, and easy to setup. Below you can see an example of how to send a push notification:

include __DIR__. '/vendor/autoload.php';

$pushover = new \Scottymeuk\Pushover\Client(['token' => '']);
$pushover->message = 'testing';

// Push Single
$push = $pushover->push($token);

// Push Multiple
$push = $pushover->pushMultiple([
    $token1,
    $token2
]);

The only downside to pushover.net is that the app costs, but with the amount of things I use it for, its been worth it.

If you wish to try out the library, then you can view it on Github.

Can't think of a use case? I built a quick CLI tool using the library to make it easy to push things to your mobile from your desktop. You can view that on Github too.

If you do happen to use any of these, please let me know in the comments below.

Supervisor + PHP + Nginx

Scott Robertson — Sun, 25 Aug 2013 12:00:00 +0000

While reinstalling my Mac today I realised how easy it was to get PHP and Nginx working with Supervisor. However, if you asked me this the first time I set up my Mac, I probably would have screamed at you for not helping me.

Supervisor allows you to manage any process with ease, and through a simple web UI. You can manage anything from PHP itself to long-running scripts. We use it on romhut.com to manage the upload workers which are written in PHP, its very powerful to use, once you know.

I figured I'd write a blog post to explain how simple it is and act as a copy and paste reference for me in the future.

I am going to assume you have the following installing:

Homebrew
PHP (with "--with-fpm" option)
Nginx

First, we need to install Supervisord, to do this we need to install "pip". You can do this by running the following commands:

easy_install pip

This will then allow you to run:

sudo pip install supervisor

We can now create our supervisord.conf file, which will tell Supervisor how and what to run. I created mine in /usr/local/etc/supervisord.conf. Note that you can create it in a few different locations and Supervisord will automatically pick it up, have a look at their docs for this.

The following is my supervisord.conf file, which includes configs to run the web interface:

[inet_http_server]
port = 127.0.0.1:9001

; Deamon
[supervisord]
logfile = /var/log/supervisord.log
logfile_maxbytes = 50MB
logfile_backups = 5
loglevel = info
pidfile = /tmp/supervisord.pid
nodaemon = false
minfds = 1024
minprocs = 200
user = root
directory = /tmp
strip_ansi = true

; RPC Interface
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

; CTL
[supervisorctl]
serverurl = http://127.0.0.1:9001

[include]
files = /usr/local/etc/supervisor.d/*.conf

If you notice on the last line, we are including files from /usr/local/etc/supervisor.d. This means we can place config files for PHP, Nginx etc in this folder to keep it cleaner, however, you can place all the configs in the above file if you so with.

First off, we will create the config file for php-fpm in /usr/local/etc/supervisor.d/php.conf :

[program:php]
command = /usr/local/sbin/php-fpm
user = root
autostart = true

The above will run PHP on startup as root.

Next we will add the Nginx config file in its respective file:

[program:nginx]
command = /usr/local/bin/nginx
user = root
autostart = true

This will also run nginx on startup as root. You will also want to add the following to your main nginx config file:

daemon off;

This will stop nginx from daemonizing it's self and is needed for nginx to run smoothly.

Run the following command to tell Supervisor to look for config file changes. Please note that you will need to run this every time you make a change to the config files.

supervisorctl update

That should be it all set up ready for you to get these processes running. Simply type the following to test this out:

supervisorctl start php;
supervisorctl start nginx;

PHP and Nginx should now be running, to check this simply run. You should see "RUNNING":

supervisorctl status php

To get Supervisord to start when your Mac starts, you will want to use launchctl. Simply put the following inside /Library/LaunchDaemons/com.agendaless.supervisord.plist :

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>KeepAlive</key>
    <dict>
        <key>SuccessfulExit</key>
        <false/>
    </dict>
    <key>Label</key>
    <string>com.agendaless.supervisord</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/supervisord</string>
        <string>-n</string>
        <string>-c</string>
        <string>/usr/local/etc/supervisord.conf</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

And run:

launchctl load /Library/LaunchDaemons/com.agendaless.supervisord.plist

At this stage, Supervisord should be running and ready to use, however, I do normally have to restart my Mac for things to work properly. This could have been due to launchctl having not been used before this.

To check that it is running, simply go to http://127.0.0.1:9001 in your browser, or use the following command:

supervisorctl status

If all works well, you should see the following in your browser:

If you have any questions or suggestions please let me know in the comments below, or tweet me

Dropbox Server Backups

Scott Robertson — Sat, 24 Aug 2013 12:00:00 +0000

Over the past few months I have been searching for a backup solution for my VPS's. I wanted a single solution that allowed me to backup multiple sources such as MongoDB, MySQL and the usual files.

After a while searching, I decided I would build it myself, due to not being able to find the perfect solution.

Before this, I simply had the Dropbox service running on each machine, and had a cron that copied mysqldump into the Dropbox folder, which was synced. This worked well, but it was quite laborious to setup.

Because of this, I opted to use the Dropbox API directly to backup from the tool. This allowed me to deploy the script to any server (see here) and the only dependencies are PHP and Curl.

When setting it up, all you need to do is run:

bin/console dropbox:auth

This will give you an authorisation link for Dropbox, which will return a token which is used to build your config file.

Once you have set the config file up (see the repo's README.md for details). You will be able to simply setup a cron to run the following for instance:

bin/console export:mysql

This will loop over each database you have access to, mysqldump them, gzip them and upload them to Dropbox. My MySQL (and MongoDB) backups, are set to backup once per hour, but the file is stored YMD, which means that the file will be overwritten. This would normally be a bad thing since you could overwrite with a bad backup easily, but because we are using Dropbox, it keeps internal revisions meaning that we have around 23 copied per day, but we keep the storage space to a minimum.

If you would like to view the source, and maybe use the tool, then please head over to Github. Let me know if you have any questions, or suggestions.

Git Deployments

Scott Robertson — Thu, 22 Aug 2013 12:00:00 +0000

For the past year or so I have been using Rsync to deploy my sites, which has worked perfectly for me until recently.

I have recently switched to using a simple post-receive hook using a bare repo on the server. I find this works a lot better for me now as it means all I need to do is "push".

First, you need to set up the repo on your server, I normally set it up in /var/git/site.com for example. This will be a bare git repo, so it will not contain any of your own code. To set this up simply run the following inside your /var/git/site.com folder:

git init --bare

This will initialize the repository, allowing you to push your code to it.

The next step is to tell git where to check your code out too. I usually use /var/www/site.com. For this, I use a very simple post-receive hook that checks the code out to the folder and runs composer install. You would place the following in /var/git/site.com/hooks/post-receive :

WORKING_DIR=/var/www/site.com;
GIT_WORK_TREE=$WORKING_DIR git checkout -f;
cd $WORKING_DIR && composer install -o;

One thing to remember is to make the file executable by running the following command:

chmod +x /var/git/site.com/hooks/post-receive

Now that the repo and post-receive hooks are setup, we need to set up your development machine's git remotes. The easiest way to do this is:

git remote add production user@site.com:/var/git/site.com

This will mean that you can simply run the following command to deploy your website:

git push production master

You can obviously add anything else you wish to the post-receive hook, such as clearing cache, flushing cdn etc. I currently have most of mine set to restart php-fpm after composer install.

service php5-fpm restart

If you have any questions, or I have missed anything, then please let me know below.

Route all .dev URL's to 127.0.0.1

Scott Robertson — Thu, 18 Apr 2013 12:00:00 +0000

If you're like me, you always forget to edit the /etc/hosts file when you want to view a local site.

To get around this, you can use the following script to route all your .dev urls to 127.0.0.1 (or any other IP). So you could go to "romhut.dev" and that would load from 127.0.0.1.

brew install dnsmasq
mkdir -pv $(brew --prefix)/etc/
echo 'address=/.dev/127.0.0.1' > $(brew --prefix)/etc/dnsmasq.conf
sudo cp -v $(brew --prefix dnsmasq)/homebrew.mxcl.dnsmasq.plist /Library/LaunchDaemons
sudo launchctl load -w /Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist
sudo mkdir -v /etc/resolver
sudo bash -c 'echo "nameserver 127.0.0.1" > /etc/resolver/dev'

If you wish to use another IP, only change the first 127.0.0.1, otherwise it will look for a name server on the host.

Select A Character in a String with PHP

Scott Robertson — Fri, 01 Feb 2013 12:00:00 +0000

I love finding little thing in PHP that I did not know before. They are generally not important or advanced but it's still very interesting. Here are a few I found recently:

Select a character with a string without using substr etc:

$string = '1234';
echo $string[1]; // 2

Another one i found was "__halt_compiler", it's one of the ones i have no real use for but interesting nonetheless. It basically stops the PHP compiler so you can just output HTML from then on without any more server resources being used.

__halt_compiler();

I shall no doubt find a lot more of these, and i will have no use for any of them more than likely.

Google's Mod_Pagespeed

Scott Robertson — Tue, 23 Oct 2012 12:00:00 +0000

mod_pagespeed speeds up your site and reduces page load time. This open-source Apache HTTP server module automatically applies web performance best practices to pages, and associated assets (CSS, JavaScript, images) without requiring that you modify your existing content or workflow.

When I was in the process of setting up my new VPS, I decided I would try out mod_pagespeed (conveniently it had just come out of beta a few days earlier). It turns out, it's very easy to set up and very easy to use.

First of all, you need to download the correct package at:

https://developers.google.com/speed/docs/mod_pagespeed/download

Once you have downloaded it, its as simple as running:

dpkg -i mod-pagespeed-*.deb
apt-get -f install
Or for CentOS you run
yum install at # if you do not already have 'at' installed
rpm -U mod-pagespeed-*.rpm

The default install includes things such as the minification of CSS and js files and also the combining of CSS files (js can be enabled too). Inline images, CSS, and js is also enabled by default, which allows these types of files to be included in the main HTML layout if they are small enough to justify doing so. This will save requests to the server for more files.

As well as the defaults, i decided to enable a few none default options in the config file:

/etc/apache2/mods-available/pagespeed.conf
The ones i decided to enable where the following:
ModPagespeedEnableFilters inline_preview_images # Load low quality images before loading high quality ones
ModPagespeedEnableFilters resize_images # Resize the images before serving them (These are then cached in Varnish)
ModPagespeedEnableFilters insert_image_dimensions # If any image does not have width, height set, then insert them
ModPagespeedEnableFilters combine_javascript # Combine javascript files into one file
ModPagespeedEnableFilters collapse_whitespace # Minify the HTML output of the page
ModPagespeedEnableFilters resize_mobile_images # Resize smaller images on mobile
ModPagespeedEnableFilters remove_comments # Remove comments from JS,CSS and HTML files.

Some are not 100% ready for production but the risk value of them is quite low.

From initial tests, it seems to have reduced the page load by about 1/3. Which on a small site may not be a lot, but on a big site with a lot of images etc, this could be a huge saving in bandwidth costs, and also a lot nicer experience for the user.

Copy SSH Keys to Server

Scott Robertson — Fri, 12 Oct 2012 12:00:00 +0000

When you wish to log in to a server without having to enter a password, all you need to do is log in with SSH. However I do not know why, but it took me hours to find a simple way to do this a few years ago.

First of all, you need to generate your SSH keys using the following:

ssh-keygen

From this point, I generally just hit enter and use the defaults. You can set a password, but that can get annoying.

Now you need to copy the SSH keys to the server you wish to log in to. I have found many ways to do this, but none have been as simple as the following:

ssh-copy-id username@server.com

You will then be asked for your password for the last time. Once this has complete, you will be able to login to the server using just:

ssh username@server.com