0

Im building a simple REST API with ruby on rails that allows users to easily create an account. Recently I have tried to secure the API with an API token. I have been testing my API with the Advanced Rest Client that is found on the Google chrome web store. As far as I know it has worked as when I try to access the calls I get a message from my REST client test application that looks like this:

enter image description here

The problem comes when I try to authenticate successfully with the Advanced Rest Client. Here is the controller code that I use to create the token and check to see if the user authenticated:

class Api::UserController < ApplicationController
  skip_before_filter  :verify_authenticity_token

  TOKEN = "secret"
  before_action :authenticate

  def index
    @users = User.all

    respond_to do |format|
      format.json { render json: @users }
    end
  end

  def create
    @user = User.new()
    @user.first_name = params[:first_name]
    @user.last_name = params[:last_name]
    @user.email = params[:email]
    @user.password = params[:password]

    respond_to do |format|
      if @user.save
        @response = {:status => "201", :message => "User successfully created."}
        format.json { render json: @response, status: :created }
      else
        format.json { render json: @user.errors, status: :unprocessable_entity }
      end
    end
  end


  # private methods in the UserController class
  private

  def authenticate
    authenticate_or_request_with_http_token do |token, options|
      token == TOKEN
    end
  end
end

It's fairly simple and seems to be doing its job as I haven't been able to authenticate with the Advanced Rest Client. I have tried to set an API token in the HTTP headers but can't seem to get the syntax correct. Here are a few examples of what I have tried:

enter image description here

and,

enter image description here

and finally,

enter image description here

What am I doing wrong? Is the API token not stored in a HTTP header? Please help!

1 Answer 1

3

Your header is incorrect, the key should be Authorization

Try putting this as the Raw header:

Authorization: Token token=secret

Sign up to request clarification or add additional context in comments.

3 Comments

thank you that seemed to work I just had to put secret in "" the final line was Authorization: Token token="secret"
I think I am going to use a UDID for the actual key. Is there a more secure way to do this, something that doesn't have the API key hardcoded into every single controller I use for the API? What is best practice for something like this in rails? @Simon
@ScottOBot yea I'd generate a token per user/account using something like SecureRandom.hex. This is a good post about best practices: blog.envylabs.com/post/75521798481/…

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.