Update 2: Redditor gramathy just informed me it’s also working in Safari, if those of you in that world are willing to run a quick test for me. @erikbrannstrom told me it’s also working in Firefox 4 Beta.

Update: If you run Google Chrome, I have a demo running publicly right here – if you could reply with your FPS count (lower-left) and system info you feel is relevant, it would be much appreciated.

Gaming has always been a passion of mine and as any of my friends can tell you, I’m constantly coming up with ideas for new games. Unfortunately, my expertise in this little programming world has been primarily delegated to the world of web development. Thankfully, with HTML5 on the horizon, I can finally combine these two passions of mine into one package of pure awesome and peak out my nerdometer to its maximum.

I’ve spent the last 6 hours working on a JavaScript game engine, using HTML’s new canvas element, that is based off of the extremely fun and easy to use Love2d game engine for Lua. Now, there is a bare minimum of functionality here thus far but I’m having a lot of fun working on this and I think it’s a great foundation to continue working off of. I shared a few quick screenshots on Forrst, of my first and second example demos – complete with code and performance summaries; but, I also wanted to record a quick demo so everyone could see this bad boy in action.

The video below (HD available on YouTube) sits just under 10 minutes and will introduce you to the engine, I discuss what my goals are in basing the API off of Love2d’s API and I actually rebuild my second example demo and bounce a square around the screen! Check it out and let me know what you think in the comments!

Looking over sites like Google Trends or Twitter Search I often find myself wondering, “What is X, and why is it trending?” For example, Gary Mason is currently trending on Twitter – I have no clue who this is or why they are trending. KnowYourTrend quickly puts all of this information on the front page and you quickly learn he was a pretty big-deal British boxer that recently passed away.

There’s still a lot of work to be done for sure: bringing in more APIs (YouTube and Amazon are currently on the priority list); relating pages to one another (you could quickly check out why Orlando Bloom is trending, discover his wife Miranda Kerr just went into labor and go check out her page as well); among various other ideas.

Overall, it’s been a fun little diversion from my main project right now, AfterMil, that (runs and looks at repository) only took 48 hours to turn around from concept to deployment.

As the entire CodeIgniter community runs over to Mercurial and Bitbucket, thanks to EllisLab’s huge announcement earlier today it seemed only fitting to get ErkanaAuth hosted over there as soon as possible.

Honestly, I’ve been wanting to do something like this for a lot of my open-source work for a long time; I just keep putting it off. I love the distributed environment for collaborating on projects like this, because you guys probably have a lot of great ideas for this library! Now, you can contribute as well!

Go ahead: check out the repository, fork it, make some changes and send me pull requests so I can look over them. You can check out my original post for my thoughts in where I see this library headed.

In November 2007 I released an authentication library for CodeIgniter named ErkanaAuth. It was very simple to use since it just provided a few methods to make authentication simpler for you – it didn’t hijack the entire process. The post announcing that library, and the code, has long since been lost but you can still read the original post thanks to Archive.org’s Wayback machine.

Recently, I’ve taken on a personal project of a rather grand-scale and have started factoring out the authentication logic into a library of it’s own, which I am referring to as ErkanaAuth 2.0. I am now releasing the library in its current state which is vastly unfinished! Nonetheless, I would love to hear your thoughts on the direction the library is headed and features you would like to see.

I don’t think I can reiterate this enough at this point in time, this is hardcore alpha – I should have called this ErkanaAuth Version 2.0ha-dont-fucking-use-me-in-production-code. I mean, in theory you could use this, and if its a library you want to use in future applications I strongly encourage you to give it a go. The authentication mechanism is secure but the library as a whole is sorely lacking in features at this point and is pretty hard-coded to a strict environment.

Features

• Authentication via username or email address and password.
• Account creation using username or email address as unique identifier.
• Locking of controllers/methods to logged-in users in one line.
• Passwords are hashed with a salt prior to storing in the database.
• User token stored in session is a hashed representation of the user’s ID and their password hash. Encrypting the session cookie via CodeIgniter’s config/config.php file adds another layer of security against altered session data.

Planned Features

• Exponential delay on failed login attempts.
• Group-based authorization system.
• Require email validation on account creation.
• Optional Captcha on account creation.
• Linking of Facebook / Twitter authentication to Erkana Auth Account.
• Forgotten password resets.
• Extensive account API for building of authentication administration panels.
• Extensive group API for building of authorization administration panels.

Installation

The downloadable package includes a number of directories and files within those directories. It is advised to extract the archive in a temporary location, ensure there are no naming conflicts with your current application and then move the directories into your CodeIgniter application’s directory. The most common naming conflict will be with the models/account.php file. The list of files included are:

• helpers/erkana_auth_helper.php
• language/english/erkana_auth_lang.php
• libraries/Erkana_auth.php
• models/account.php
• sql/1-create_accounts_email.sql
• sql/1-create_accounts_username.sql

After installing the library within your application directory you must decide whether your application will authenticate based on username/password or email/password and run the correct SQL file on your database schema. This file will create a table named accounts, the statement run by sql/1-create_accounts_email.sql is:

If you run sql/1-create_accounts_username.sql the following statement will be executed:

Usage

ErkanaAuth aims to be as simple as possible in its usage. As of this version, this is primarily due to the limited scope of its functionality, but the overall feel for the library will differ as little as possible from what can be seen as of now. Many of the limitations on the library (i.e., strict naming of form fields) will be corrected as development continues.

ErkanaAuth does not assist in the creation of any front-end related code (i.e., user registration forms, login forms) at this time. ErkanaAuth simply provides a powerful set of methods to be used within your controllers to assist in getting an authentication system up and running as quickly as possible. Additionally, there is a helper function to display useful error messages to your users for invalid form submissions.

Creating a User

The create_account() method accepts a single string parameter of either email (default) or username, which should reflect the authentication mechanism you opted for during the installation and execution of the SQL file earlier. This method will return TRUE or FALSE if the user was created and can be used similarly as to how the standard form_validation library is used.

The library currently requires the following form fields to be present with the corresponding rulesets:

• email: Only if you select the email authentication mechanism (required|max_length[120]|valid_email|trim)
• username: Only if you select the username authentication mechanism (required|min_length[4]|max_length[20]|trim)
• password: Always required (required|matches[passwordconf])
• passwordconf: Always required (required)

The controller method that displays and processes your account creation form should call the create_account() method and redirect on TRUE, otherwise loading the view file that contains your account creation form. In the following example, the user is redirected to accounts/index() which would display our login form.

Validating a User’s Login Credentials

The validate_login() method accepts a single string parameter of either email (default) or username, which should reflect the authentication mechanism you opted for during the installation and execution of the SQL file earlier. This method will return TRUE or FALSE if the credentials are valid and can be used similarly as to how the standard form_validation library is used.

The library currently requires the following form fields to be present:

• email: Only if you select the email authentication mechanism
• username: Only if you select the username authentication mechanism
• password: Always required

The controller method that displays and processes your login form should call the validate_login() method and redirect on TRUE, otherwise loading the view file that contains your login form. In the following example, the user is redirected to announcements/index() which would display a “dashboard” like page and only be accessible to logged in users.

Validating a User’s Logged-in Status at Page Load

The required() method provides a simple, one-line, way to validate a user’s session and ensure the user is logged into a valid account. This line should be placed within the constructor of any controller class you would like to complete protect or as the first line of a method you would like to protect. The following example is a controller named Announcements that currently only has its index() method protected. Any other methods added to this controller would not be protected without either moving the required() method to the constructor or placing a call to the required() method within the controller methods themselves.

Displaying Errors on Invalid Form Submissions

The library includes a helper with the function authentication_errors() to assist in displaying errors upon form submission. This function will return all errors, delimited by a
. If there are no errors, NULL is returned. In the following example, we are displaying a login form that will display errors at the top of the form if any exist from prior submission attempts:

Technical Details

During account creation an alphanumeric string is randomly generated to serve as the user’s salt. This salt is then hashed with the user’s password and the resulting hash is stored in the database to validate against.

On a login attempt, the database is queried for a record based on your authentication mechanism (email or username). That record is then compared against the user submitted data for validation. On a successful validation, session variables are stored consisting of the record’s id and a hash of the record’s id field and password_hash field.

When a user visits a protected page the session is first checked for the variables that are set by a successful login. If these session variables exist, the database is queried for the record identified. If this record exists, the session is further validated by comparing the stored hash of the record’s id and password_hash with the data that is stored in the record.

Download

Erkana Auth 2.0a is available for download. At this early stage of development a version control repository has not been made publicly available. In the future, Subversion and Git repositories will be made available.

License

ErkanaAuth 2.0a is licensed under the BSD License as defined by the Human-Readable Creative Commons Deed.