Some best practices for authentication in Ruby on Rails
The article distinguishes authentication from authorization, recommends clearer names for authentication accessors, argues for separate authentication sessions, and warns that auth gems can add security and maintenance risks.
