RailsConf 2025 Unraveling the black box: past, present and future of... by Alicia Rojas

Unraveling the black box: past, present and future of authentication in Rails by Alicia Rojas We often treat authentication as a black box because we’ve been standing on the shoulders of giants (aka Devise). Recently, a long-awaited feature has shipped with Rails 8: a built-in authentication generator! Let’s explore how the new default works and what we can learn from history and precedents when creating our authN flows. Session structure: 1. Understanding authentication and its precedents - A brief history of authentication on the web - History of Devise and major precedents for authentication used in Rails - How did authentication become part of the framework? 2. Authentication generator - Key elements of the generator's source code - Setting up relevant use cases for modern web apps: a) Passwordless Authentication (Passkeys & WebAuthn) b) OAuth & Single Sign-On (SSO) c) Role-Based & Attribute-Based Authentication for Admin & API Security 3. Pitfalls and takeaways - Main security threats and future opportunities - Lessons learned from the process Expected outcomes: - Basic and practical knowledge on how to implement modern authentication flows using the new Rails generator. - To become aware of authentication use cases alternative to password-based. Intended audience: Software developers (all levels welcome!), product designers.