Creating JSON API inside existing Rails app

Question

I'm having Rails web-app that has a form that pushes a request of a certain document into DB. A script on other machine should ask for newly created request. To handle that I've diced to add small JSON API inside the app.

For that purpose in routes I've added

  defaults format: :json do
    get "/api_name/get_request", to: "api_name#get_request"
  end

After that I've met CSRF problem. And after googling I've found out that I need to add protect_from_forgery unless: -> { request.format.json? } in my controller. It looks like the code as follows

class ApiNameController < ApplicationController
  protect_from_forgery unless: -> { request.format.json? }

  def get_request
    render json: {message: 'Received'}, status: :ok
  end
end

After that in log I have

Started GET "/api_name/get_request" for ::1 at 2018-02-05 16:43:08 +0300
Processing by ApiNameController#get_request as JSON
  Parameters: {"api_name"=>{}}
Completed 401 Unauthorized in 5ms (ActiveRecord: 0.0ms)

So the problem is still there. The questions are

What should I do to solve the problem?
Allowing JSON requests from any origin seem to be dangerous. How can I ad some protection? Maybe I should send some header from remote machine and check it inside verified_request ?

UPD I've changed comment inside get_request with render json: {message: 'Received'}, status: :ok and after that the result is the same

This is a 401 response, which suggests a different error. In my apps CSRF errors return 422 status. Are you using Devise or another authentication system? Also, have you tried boosting your log level to debug — Phil
– Phil, Commented Feb 5, 2018 at 14:08
@Phil, yes I have before_action :authenticate_user!, :unless => :devise_controller? in app controller — Eugeny89
– Eugeny89, Commented Feb 5, 2018 at 14:16
if u need an authentication actions, let me know i can update the post... — 7urkm3n
– 7urkm3n, Commented Feb 5, 2018 at 14:31

7urkm3n · Accepted Answer · 2018-02-05 14:26:13Z

2

You have to skip devise before_actions, if its assigned in ApplicationController.

Controllers:

class ApiController < ApplicationController
   protect_from_forgery unless: -> { request.format.json? }
   skip_before_action :authenticate_user!, only: :get_request

   def get_request
      render json: {message: 'Received'}, status: :ok
   end

end

Routes:

namespace :api, defaults: { format: :json } do
   get 'get_request' => 'api#get_request'
end

To handle cross origin:

Rack Cors Gem Link

Rack Attack Gem Link

answered Feb 5, 2018 at 14:26

7urkm3n

6,3304 gold badges33 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

nattfodd · Accepted Answer · 2018-02-05 14:15:56Z

1

You probaly have some web authentication in ApplicationController in before_filter, since your ApiNameController inherits from it. That's why you receive Unauthorized response. So you should either stop inheriting from it, or exclude api controller methods from web-auth before-hook with some sort of:

class ApiNameController < ApplicationController
  skip_before_action :authenticate_user!, only: :get_request

Speaking of security, you have at least two options:

The last one is less secure than token-based auth, but it's easier to implement, so it's up to you which one to chose.

answered Feb 5, 2018 at 14:15

nattfodd

1,9201 gold badge21 silver badges37 bronze badges

Collectives™ on Stack Overflow

Creating JSON API inside existing Rails app

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related