Sometimes you don’t need a complex authentication approach for a project. Let’s say that you’re working on the first iteration of a mobile app with a Rails-based API. You need to authenticate a user, but you don’t want to implement something like OAuth 2.
Rails has this built-in, but it doesn’t seem to be that well known. We’ve never written about it, and I’ve found myself finding it very useful again recently.
It’s called authenticate_or_request_with_http_token.
Implementation
module Api
class BaseController < ApplicationController
before_action :authenticate
private
def authenticate
authenticate_or_request_with_http_token do |token, _options|
User.find_by(token: token)
end
end
def current_user
@current_user ||= authenticate
end
end
end
On every request, we take out the token then try and find a user associated with it.
Unfortunately, this approach exposes you to a timing attack. There’s not a good, general solution to this problem so you should think about it before implementing something similar.
In fitting with the typical pattern of implementing current_user, we do the
same here too.
As an example, we might talk to an API implemented this way with curl like
this:
curl -H "Authorization: Token abc123" http://localhost:3000/api/test
Testing
We might go about testing this like so:
require "rails_helper"
RSpec.describe "Authenticating with the API" do
before do
Rails.application.routes.draw do
get "/api/test" => "test#index"
end
end
after do
Rails.application.reload_routes!
end
context "when the user provides a valid api token" do
it "allows the user to pass" do
create(:user, token: "sekkrit")
credentials = authenticate_with_token("sekkrit")
get "/api/test", headers: { "Authorization" => credentials }
expect(response).to be_successful
expect(response.body).to eq({ "message" => "Hello world!" }.to_json)
end
end
context "when the user provides an invalid api token" do
it "does not allow to user to pass" do
create(:user, token: "sekkrit")
credentials = authenticate_with_token("less-sekkrit")
get "/api/test", headers: { "Authorization" => credentials }
expect(response).to be_unauthorized
end
end
private
TestController = Class.new(Api::BaseController) do
def index
render json: { message: "Hello world!" }
end
end
def authenticate_with_token(token)
ActionController::HttpAuthentication::Token.encode_credentials(token)
end
end
To isolate our test here from the rest of our application, we’re drawing a
route just for this example. Then we can test both successful and unsuccessful
responses as a request spec.
There’s also an example Rails project on GitHub which shows this action.