Versions are 0.MINOR.PATCH while the API settles. A patch fixes a defect and never
changes what a working host sees. A minor adds, and may break: when it does, the entry
opens with Breaking or Changed, says what a host must change or will notice, and
the README says "since" beside the behaviour. Every release is on Clojars as
dev.arkaitz/auth-base and tagged vX.Y.Z.
:on-logout that throws no longer leaves the person signed in. The
exception is logged through tools.logging, with its stack and nothing from the request,
and the session is ended all the same; an interrupt and an Error still pass. Signing
out is the security act, and a host's record of a device is not.dev/arkaitz/auth_base/migrations, which db-base
0.4.0 runs before the host's with :libraries — a host stops copying them, and a later
schema change arrives with the version. Remove the copies from your migrations and
recreate a development database that recorded them under your ids.:i18n :locales: the standard
pages' Spanish is served only by a host that lists :es. On 0.11.0 an English-only
host answered a Spanish browser with a Spanish login and <html lang="es"> on every
page.dev.arkaitz/web-base 0.11.0, so a consumer receives web-base and
what it brings. Only dev.arkaitz.auth-base.web and .testing load it; the ceremony,
handlers, session, stores and facade still run under any Ring host.dev.arkaitz.auth-base.web: plugin, one line of web-base's :plugins installing
the login routes with a standard view inside the host's :layouts, /ab/ab.css, an
English and Spanish dictionary of every string, the subject function and the login
path; five links per source every fifteen minutes by default. The view and its parts
(view, notice, sign-in-form, confirm-form), sign-out and identity for the
shell's slot are public. Brand it with --ab-*/--wb-* properties, the ab-*
classes, :ab/ keys in the host's dictionary, or a :view of the host's.:revoke-path, a POST that signs the subject out everywhere; :on-logout
and :on-revoke, for a host's own records of a device. :logout-path is now checked
like :login-path.testing: sign-in, open-link, sign-out and mailbox-reader walk the pages as a
person does; sign-in throws, naming the identifier, where a walk would otherwise go
on signed out.resources/ (the stylesheet).{:confirm? true}, whose form posts to the link, and only that POST —
behind the host's CSRF — redeems. A mail gateway's scanner that fetches the link
spends nothing, and a page elsewhere can no longer sign a visitor in as the attacker
who requested it. A view that ignores the new state renders its ordinary form there,
posting to the link, so its button still signs in — give it the one button. The
page carries the token in its address, so it is no-store and
Referrer-Policy: no-referrer.revoke! also drops the subject's links not used yet, so a link issued
before a revocation no longer signs in after it. A store must implement the new
store/Challenges protocol (identifiers-of, drop-challenges!), checked at
construction; the in-memory and JDBC stores do. The JDBC ddl gains an index on
login_challenge(identifier): add it as a migration.issue!, and
the form answers it as any unusable input — it would have reached deliver!, where a
mailer writes headers.next (web-base 0.10.0's gate sends one) and the
redemption lands there instead of :after-login.:rate-limit function may answer {:allowed? … :retry-after-ms …}, and the 429
then carries its Retry-After; auth/fixed-window-decider is re-exported.dev.arkaitz.auth-base.testing: a clock the test moves, a mailbox for :deliver!,
token-of, the recording store and the five view states.wrap-revoked judges a request as it arrived, before its handler runs,
and takes a :wb/subject that is not nil as live: under web-base a signed-in page
reads the revocation generation once, not twice. A revocation made while a handler
runs drops the session at the next request.:keep-session on the handlers: keys of the session a redemption arrives with that
the signed-in session keeps — a language chosen before signing in. :ab/ keys and
the CSRF token are refused.:deliver-with-request! on the ceremony, in place of :deliver!: the delivery gets
the request that asked, so the message can speak its language. issue! takes the
request as an optional third argument.:wb/log-path :template, so web-base 0.9.0 and later log
it without its token (the test that proves it runs against 0.9.0).:action and :field.:ttl-ms or a rate limit :window-ms the constructor accepts can no longer
overflow into a 500.jdbc/reclaim-expired! refuses a now that is not a number, and its refusals carry
:config-key [:datasource].ADA@IX.TEST became ada@ıx.test.clojure.tools.logging, naming only the
address's domain.jdbc/check! names the table it could not read; jdbc/latest-challenge-token.:on-unknown returns must be = to what subject-for answers for
that identifier afterwards; a redemption whose hook answers otherwise is refused.dev.arkaitz.auth-base.console/deliver!, a delivery for development.jdbc store over a DataSource.:on-unknown, for a host that registers on first redemption.normalise, the spelling the store is asked for.Retry-After saying when the
window reopens.Can you improve this documentation?Edit on GitHub
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |