AuthHMAC

AuthHMAC is a useful Ruby library for HMAC based authentication of HTTP Requests, net/http, ActiveResource, and Rails controllers. HMAC authentication is a two-way form of communication, and it involves a shared secret key that is used by both the client and the server. For the client to send a request, they must first sign the request using the secret key, and they do this by building a canonical representation of the request then generating a HMAC of the request using the secret.

The generated HMAC is then transmitted as part of the request. When the server receives this request, it too must build the same canonical representation and generate its own HMAC using its copy of the secret key. If the HMAC matches the HMAC sent by the client, the server can be assured that the client has the shared secret key. This type of authentication ensures message integrity because it combines the content and the shared secret of the request.

AuthHMAC was developed by Peerworks for authentication between various Peerworks applications. Although loosely based on the Amazon Web Services authentication scheme, AuthHMAC accepts other applications without Amazon specific components. HMAC Authentication is best used for communication between applications such as web services because it provides better security than HTTP Basic authentication without the need to set up SSL.

Of course, SSL is necessary if you need to protect the confidentiality of the data; otherwise, AuthHMAC is an effective choice that can authenticate requests during transit without sending credentials in the clear. It's important to note that AuthMAC is licensed and provided under the terms of the MIT License.