Mimic .htaccess or some other type of password protecting with webrick

Question

I have a rails app that I enjoy developing on a sever much more than locally, slow computer, the problem is even though on the server the development environment is great I need a way to look at the pages I am working on live.

This is pretty easy if I didn't care about the app being visible to the public but it cannot be visible anywhere except on the production server.

So I had the idea of just putting a basic httpauth up and then only I can see the rails app but it is still hosted on the server.

If I were to be doing this with apache/php I would just use a .htaccess file to protect the directory but I have no clue how to protect the application from the public using WEBrick.

If anyone has any idea I really would like to have no code changes or only code changes in files I can .gitignore so deployment is still easy.

Answer 1

You can restrict access by using Rack based basic auth or IP white listing

Basic Auth

Add the following to your config/environments/development.rb

config.middleware.use Rack::Auth::Basic, "Beta Access" do |username, password|
  'secret' == password
end

IP White Listing

I found two gems for this purpose:

rack-auth-ip

rack-ip-whitelist

I would use rack-auth-ip as it has been there for some time. Add the following to your config/environments/development.rb

config.middleware.use Rack::Auth::IP, %w( YourIPAddress )

Now, the instance is accessible only if the originating IP is in the white list.

Answer 2

This question Ruby Webrick HTTP Authentication seems to give an answer

Here's a link to some Webrick docs. It looks like you need something like so, from the above link:

realm = "Gnome's realm"
start_webrick {|server|
  server.mount_proc('/convenient_basic_auth') {|req, resp| 
    HTTPAuth.basic_auth(req, resp, realm) {|user, pass|
      # this block returns true if
      # authentication token is valid
      user == 'gnome' && pass == 'supersecretpassword'
    }
    resp.body = 
      "You are authenticated to see the super secret data\n"
  }
}

and a link to the rdocon WEBrick/HTTPAuth

config = { :Realm => 'DigestAuth example realm' }

htpasswd = WEBrick::HTTPAuth::Htpasswd.new    'my_password_file'
htpasswd.auth_type = WEBrick::HTTPAuth::DigestAuth
htpasswd.set_passwd config[:Realm], 'username', 'password'
htpasswd.flush