Shield is a comprehensive security solution for Lucky framework. It features robust authentication and authorization, including user registrations, logins and logouts, password resets and more.
Shield is secure by default, and exploits defence-in-depth strategies, including pinning an authentication session to the IP address that started it -- the session is invalidated if the IP address changes.
User IDs are never saved in session. Instead, each authentication gets a unique ID and token, which is saved in session, and checked against corresponding values (hashed) in the database.
Shield is designed to be resilient against critical application vulnerabilities, including brute force, user enumeration, denial of service and timing attacks.
On top of these, Shield offers seamless integration with your application. For the most part,
include a bunch of
modules in the appropriate
classes, and you are good to go!
Find the complete documentation of Shield in the
docs/ directory of this repository.
Run tests with
docker-compose -f spec/docker-compose.yml run --rm spec. If you need to update shards before that, run
docker-compose -f spec/docker-compose.yml run --rm shards.
If you would rather run tests on your local machine (ie, without docker), create a
#!bin/bash export APP_DOMAIN=http://localhost:5000 export DATABASE_URL='postgres://postgres:password@localhost:5432/shield_spec' export SECRET_KEY_BASE='XeqAgSy5QQ+dWe8ruOBUMrz9XPbPZ7chPVtz2ecDGss=' export SERVER_HOST='0.0.0.0' export SERVER_PORT=5000
Update the file with your own details. Then run tests with
source .env.sh && crystal spec.
- [x] User registrations
- [x] Logins and logouts
- [x] Password resets
- [x] Login notifications
- [x] Password change notifications
- [x] Pin authentication session to its IP address
- [x] Authorization
- [ ] Email confirmation (verification)
- [ ] Anti-spam
- [ ] Web Application Firewall (WAF)
- [ ] Multi-factor authentication
- Fork it
- Create your feature branch:
git checkout -b my-new-feature
- Commit your changes:
git commit -am 'Add some feature'
- Push to the branch:
git push origin my-new-feature
- Create a new Pull Request
Kindly report suspected security vulnerabilities in private, via contact details outlined in this repository's