29

I want to set up a private staging server on heroku using simple http authentication. Is that possible?

6 Answers 6

53

A cleaner way is to just drop in a couple lines of Rack middleware into your staging environment config, leaving controller logic alone:

# config/environments/staging.rb
MyApp::Application.configure do
  config.middleware.insert_after(::Rack::Lock, "::Rack::Auth::Basic", "Staging") do |u, p|
    [u, p] == ['username', 'password']
  end

  #... other config
end

This tip courtesy of Ole Morten Amundsen. More info plus Heroku password specification:

http://olemortenamundsen.wordpress.com/2011/04/05/ruby-secure-staging-environment-of-your-public-app-from-users-and-bots/

2
  • This solution is cleaner and makes more sense to me because is infrastucture agnostic.
    – Juanda
    Jan 3, 2012 at 23:03
  • Please note that index.html is served directly by the web server and not Rack-Rails and thus the index.html url won't be protected. Everything else served by Rails will be protected.
    – Marc M
    Mar 9, 2012 at 10:39
14

On Rails4, I got "No such middleware to insert after: Rack::Lock" error. Replace Adam's code to the below:

# config/environments/staging.rb
MyApp::Application.configure do
  config.middleware.use '::Rack::Auth::Basic' do |u, p|
    [u, p] == ['username', 'password']
  end
  # ...
end

See: http://www.intridea.com/blog/2013/6/4/tips-and-tricks-for-deploying-rails-4-apps-on-heroku

1
  • 3
    In Rails 5, middlewares wants the actual module, rather than a string. config.middleware.use ::Rack::Auth::Basic
    – Frexuz
    Jun 21, 2017 at 4:09
7

Absolutely. The simplest solution is to just put something in your application controller that uses Rails's built in basic auth support (see here: http://railscasts.com/episodes/82-http-basic-authentication) and just wrap it in a conditional for your Rails.env. Note that on Heroku, by default the RAILS_ENV is set to production, but you can change this for your non-production apps using heroku config (http://docs.heroku.com/config-vars).

You could also consider installing some roadblock-style Rack middleware, but I'd just go with the above.

1
2

There is a nice heroku add-on that uses Mozilla Persona for authentication. It's free for low-volume sites (under 10,000 authentications per month):

https://addons.heroku.com/wwwhisper

Very easy to install and configure.

2
  • Agreed. 2 users limit is the only possible issue.
    – freemanoid
    Nov 21, 2014 at 17:44
  • 1
    US only. Also Mozilla Persona has been discontinued. On November 30th, 2016, Mozilla will shut down the persona.org services. Persona.org and related domains will be taken offline. Oct 18, 2016 at 11:55
2

Another way to do it using the application_controller.rb:

  # app/controllers/application_controller.rb
  before_filter :http_basic_auth

  def http_basic_auth
    if ENV['HTTP_AUTH'] =~ %r{(.+)\:(.+)}
      unless authenticate_with_http_basic { |user, password|  user == $1 && password == $2 }
        request_http_basic_authentication
      end
    end
  end

and then you need to export your values: for development:

 export HTTP_AUTH=test:test

For heroku:

 heroku config:set HTTP_AUTH=test:test

Now when the window prompt you should enter for user/password => test/test.

That's it hope you find it useful.

1
  • Works great, thanks! My only suggestion is to add an else so that if the HTTP_AUTH variable isn't defined, it fails safely by blocking everyone: else render file: "public/401.html", status: :unauthorized
    – bjnord
    Oct 6, 2021 at 0:58
1

Updated answer for Rails 5+. In your config/application.rb or selected environment config:

config.middleware.use(Rack::Auth::Basic) do |u, p|
  [u, p] == [ENV['USER'], ENV['PASSWORD'] || SecureRandom.hex]
end

It's been pointed out in Ole's blog post to use ENV vars. I'd add that defaulting to a random password is a good idea in case the env var is not set.

To use it only on certain paths you can create your own middleware (refer to this answer):

class AdminAuth < Rack::Auth::Basic
  def call(env)
    req = Rack::Request.new(env)

    return @app.call(env) unless admin_path?(req)

    super
  end

  def admin_path?(req)
    req.path =~ /^\/admin\/*/
  end
end

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.