Restful_authentication vs. Authlogic

Question

what do you recommend?

Authlogic or restful_authentication?

Is it hard, to build the email-activation-step into authlogic (as far as I know, Authlogic hasn't this feature included).

Answer 1

Actually I'd disagree with fig-gnuton. There are a couple of things that you could do. If you want a basic solution try restful auth but be aware that the generator based approach has significant shortcomings. The main shortcoming is that you are squirting a large gob of code into your application. So when there's an issue you have to patch the code manually or blow away any customisations you've made. Recent versions of restful auth are much better than earlier versions which spewed code left, right and centre but my advice would be where possible leave the user and session code generated by restful auth well alone. For example if you want properties on your User make another object like Person and link the two.

I prefer authlogic because:

• It feels like you're more in control.
• I appreciate the extent to which authlogic is documented and their example app is pretty useful as a guide too.
• Also I've had bother with testing restful_auth apps, not so with authlogic.
• Extensions like forgotten password resets, API keys and the like are much less custom code than restful_auth.

Answer 2

And don't forget Clearance, the other kid in the block.

Answer 3

Restful Authentication is crap. It's the kind of thing that gives Rails generators a bad name.

What do I mean by that? The generators that come with Rails are (IMHO) good. They generate a very minimalistic skeletal structure. What they generate is small, easily understood, and easy added to/replaced by your own code as you go. All the complex gnarly pieces are in the Rails libraries, where they belong, not in the generated code.

Restful Authentication, on the other hand, comes with generators that spew out massive amounts of generated code that's hard to work with and hard to maintain. Functionality that should be in a nice library where it can be easily upgrade with each new version of the framework is instead spewed out in generated model and controller code where it'll end up intermixed with your code. It's not scaffolding, it's a mass one way dump of autogenerated code.

Stay away... stay far away....