Code in

OmniAuth strategy (Ruby)

Melden Sie sich an, um Ihre eigene Test-Client-ID in den Beispielen zu sehen.

Coming soon. aton-network is not published on RubyGems yet, so the install line on this page does not work until it is. Until then, everything works over plain HTTP: pick cURL in any code block, or start from Endpoints.

omniauth/strategies/atheron is Atheron as an OmniAuth strategy, for Rails (with Devise or on its own), Sinatra or any Rack app. It comes with the atheron gem.

Install

In Rails, add omniauth-rails_csrf_protection too: OmniAuth starts a sign-in only from a POST that carries the page's authenticity token.

bash

bundle add aton-network omniauth

Add the provider

Register https://your.app/auth/atheron/callback as the redirect address. env["omniauth.auth"] then holds uid (the ID your app was given for the person, made for your app alone: key your records on it, never on email), info (name, email, nickname, image), credentials (the tokens) and extra.raw_info (userinfo's claims).

Dieses Beispiel gibt es noch nicht in cURL. Gezeigt in Next.js.

// app/auth/[...atheron]/route.ts: every Sign in with Atheron route in one file.
// Set ATHERON_CLIENT_ID, ATHERON_CLIENT_SECRET, ATHERON_SECRET and
// ATHERON_REDIRECT_URI=https://your.app/auth/callback (the address you registered).
import { Atheron } from "@aton-network/nextjs";

const atheron = Atheron();

export const { GET, POST } = atheron.handlers;

How it keeps you safe

PKCE (S256), state and nonce on every sign-in. The callback is checked by the same rules as every Atheron SDK: the state first, then the issuer, then an error Atheron sent, then the code. A failure goes to OmniAuth's failure route with its code, such as invalid_state.
An ID token that comes back is held to its issuer, audience, expiry and nonce.
The redirect address sent with the code is the registered one, never with the callback's own query.
An email Atheron has not verified is not handed on: info.email is absent for it.

Fragen Sie Atlas

KI-Assistent

Fragen Sie alles zu Mit Atheron anmelden, zur API oder zum Portal. Die Antwort kommt aus unserer Dokumentation, mit Links zu den genutzten Seiten.