使用Nexmo验证登录Ruby Sinatra应用程序

时间:2016-06-20 01:19:07

标签: ruby security sinatra nexmo

我找到了一个Nexmo Verify,但其中一些不适用于Sinatra,因为框架有一些差异,并且它不适合我所做的。任何人都可以帮助我或引导我在我的Sinatra应用程序中使用{{3}}吗?

post "/" do
  client = Nexmo::Client.new(key: 'mykey', secret: 'mysecret')
  response = client.send_verification_request(number   params[:phonenumber], brand: 'OpenINC')
  if response['status'] == '0'
    erb :code
  else
    erb :error
  end
end

get'/code' do
  erb :code
end

post '/code' do
  client = Nexmo::Client.new(key: 'mykey', secret: 'mysecret')
  response = client.check_verification_request(code: '1234', request_id: '00e6c3377e5348cdaf567e1417c707a5')

  if response['status'] == '0'
    erb :start
  else
    erb :error
  end
end

如果它说mykey和mysecret,我把我的密钥和秘密放在一起,但我不想把我的实际密钥和秘密放在Stack OverFlow上

1 个答案:

答案 0 :(得分:0)

根据上面的代码以及the repo中的代码,问题只是request_idcode值是硬编码的。

如果你:

  1. 将响应中的request_id存储到response = client.send_verification_request(number: params[:phonenumber], brand: 'OpenINC')来电,例如session[:request_id] = response['request_id']
  2. 获取用户在post /code路由中提交的代码,例如code = params[:code]
  3. request_id路线中的session检索post /code,例如request_id = session[:request_id]
  4. 检查验证请求时使用coderequest_id,例如`check_verification_request(代码:code,request_id:request_id)
  5. 然后代码就可以了。

    完整的基本示例:

    post "/" do
      client = Nexmo::Client.new(key: 'mykey', secret: 'mysecret')
      response = client.send_verification_request(number: params[:phonenumber], brand: 'OpenINC')
    
      # 1. Store request_id
      session[:request_id] = response['request_id']
    
      if response['status'] == '0'
        erb :code
      else
        erb :error
      end
    end
    
    get'/code' do
      erb :code
    end
    
    post '/code' do
      # 2. Get the user verification code
      code = params[:code]
    
      # 3. Retrieve the request_id
      request_id = session[:request_id]
    
      client = Nexmo::Client.new(key: 'mykey', secret: 'mysecret')
    
      # 4. Use the code and request_id
      response = client.check_verification_request(code: code, request_id: request_id)
    
      if response['status'] == '0'
        erb :start
      else
        erb :error
       end
    end
    

    我还提交了针对您的回购here的公告,其中this commit包含主要详细信息。