Beware the mistake you think you'll never make :)

What we've found is that there are 2 mindsets: building and breaking. When you're building a product it's super hard to switch to the breaking mindset of security, simply because mental context switching is expensive and mentally exhausting. The most important thing is to force yourself into that mode before posting anything publicly. If you don't have the security experience, have a friend or service (like ours) look it over. Data is one of the most important assets to your company (or project), and any sort of disclosure can shut you down permanently.

it's something someone would do who's never worked with authentication and authorization before and doesn't have the fallback of a professional tester (aka breaker).

As people have mentioned, rails doesn't have it built in. I've used gems to provide it since I don't trust myself to write good enough security algorithms (and really, why reinvent the wheel if I don't have to).

In .net we can use the asp.net membership. But you've always got to have that authorization part, which I think can get forgotten about unless you've got a system under you belt or something/someone to crib from.

Sometimes you just don't think, and sometimes it becomes very public.

In .NET you can protect controller action methods using `[Authorize]` data attribute above each method.

You can even create your own custom filters.

http://www.youtube.com/watch?v=BsxUsyMSGeA

Just letting you know. :)

indeed, aren't specifics, wonderful.

However, I do think that authentication is where people may believe they can stop, forgetting or maybe not understanding, that authentication really doesn't do much, without an authorization system.

Same here haha. I'd be pretty upset if that was my personal information up and available for all to see, but thankfully that wasn't the case.

How this happened is what I want to know too.