rails-api

Rails API : Best way to implement authentication?

由 雨燕双飞 提交于 2019-11-28 16:17:38
I'm writing a Rails 4 app that will expose an API for a mobile app that's yet to be developed. Users will authenticate using an e-mail and password from the mobile app. While I've found quite a bit of information on the topic. It's hard to discern what's dated or non-optimal. I've read about HTTP Basic Auth, which doesn't seem too secure, and HTTP Token-based Auth, but I'm not sure on how to couple that with regular e-mail and password authentication (I'm using Devise by the way). I'd just like to know what's the current best practice on how to implement this, so I'll be sure to be going the

Why isn't my CORS configuration causing incoming requests to be filtered? How can I make it only accept requests from a specific origin?

由 走远了吗. 提交于 2019-11-28 11:49:12
I'd like my Rails 5 API-only app, for now running on http://localhost:3000 , to only accept requests from my NodeJS front-end app, for now running on http://localhost:8888 . So I configured /config/initializers/cors.rb like this: Rails.application.config.middleware.insert_before 0, Rack::Cors do allow do origins "http://localhost:8888" resource "*", headers: :any, methods: [:get, :post, :put, :patch, :delete, :options, :head] end end And I wrote this test: #/spec/request/cors_request_spec.rb RSpec.feature "CORS protection", type: :request do it "should accept a request from a whitelisted

Build 2 middleware stacks in Rails app

由 风格不统一 提交于 2019-11-28 10:15:14
问题 I have a Rails app provides both website and api. I don't want some elements appear in API's middleware stack, for example : ActionDispatch::Cookies , ActionDispatch::Session::CookieStore or ActionDispatch::Flash . Website's middleware stack is remain as normal. So how could I do that? Thanks. 回答1: I had exactly the same situation, and wanted to do the same thing. So far I have been able to use a Rails Engine to add middleware that is missing without problems for certain routes (although it

Is devise's token_authenticatable secure?

由 无人久伴 提交于 2019-11-27 16:37:03
I'm building a simple api with Rails API , and want to make sure I'm on the right track here. I'm using devise to handle logins, and decided to go with Devise's token_authenticatable option, which generates an API key that you need to send with each request. I'm pairing the API with a backbone/marionette front end and am generally wondering how I should handle sessions. My first thought was to just store the api key in local storage or a cookie, and retrieve it on page load, but something about storing the api key that way bothered me from a security standpoint. Wouldn't be be easy to grab the

Rails API : Best way to implement authentication?

由 浪尽此生 提交于 2019-11-27 09:34:23
问题 I'm writing a Rails 4 app that will expose an API for a mobile app that's yet to be developed. Users will authenticate using an e-mail and password from the mobile app. While I've found quite a bit of information on the topic. It's hard to discern what's dated or non-optimal. I've read about HTTP Basic Auth, which doesn't seem too secure, and HTTP Token-based Auth, but I'm not sure on how to couple that with regular e-mail and password authentication (I'm using Devise by the way). I'd just

undefined method `flash' for ActionDispatch::Request

由 余生颓废 提交于 2019-11-27 05:42:59
问题 I'm trying to write an Ember application in Rails 4, and have decided to go with rails-api for the api controllers, while keeping the application controller intact for a few pages that aren't part of the single-page app. To put it in more concrete terms, here are my controllers: app/controllers/application_controller.rb : class ApplicationController < ActionController::Base protect_from_forgery end app/controllers/sample_controller.rb : class SampleController < ApplicationController # my

devise user sign_in gives authentication error for CSRF token authenticity token

由 折月煮酒 提交于 2019-11-26 21:09:51
问题 I am using devise (latest version - 3.2.0) with rails (latest version - 4.0.1) I'm doing simple authentication (without ajax or api) and getting an error for CSRF authenticity token. Check the POST request below started POST "/users/sign_in" for 127.0.0.1 at 2013-11-08 19:48:49 +0530 Processing by Devise::SessionsController#create as HTML Parameters: {"utf8"=>"✓", "authenticity_token"=>"SJnGhXXUXjncnPhCdg3muV2GYCA8CX2LVFV78pqddD4=", "user"=> {"email"=>"a@a.com", "password"=>"[FILTERED]",

Is devise's token_authenticatable secure?

由 别等时光非礼了梦想. 提交于 2019-11-26 18:45:50
问题 I'm building a simple api with Rails API, and want to make sure I'm on the right track here. I'm using devise to handle logins, and decided to go with Devise's token_authenticatable option, which generates an API key that you need to send with each request. I'm pairing the API with a backbone/marionette front end and am generally wondering how I should handle sessions. My first thought was to just store the api key in local storage or a cookie, and retrieve it on page load, but something

Why isn&#39;t my CORS configuration causing incoming requests to be filtered? How can I make it only accept requests from a specific origin?

由 徘徊边缘 提交于 2019-11-26 12:47:40
问题 I\'d like my Rails 5 API-only app, for now running on http://localhost:3000 , to only accept requests from my NodeJS front-end app, for now running on http://localhost:8888 . So I configured /config/initializers/cors.rb like this: Rails.application.config.middleware.insert_before 0, Rack::Cors do allow do origins \"http://localhost:8888\" resource \"*\", headers: :any, methods: [:get, :post, :put, :patch, :delete, :options, :head] end end And I wrote this test: #/spec/request/cors_request
订阅 rails-api