Designing Rails Authentication API

Question

I need users to authenticate through a form, but I also need to expose this authentication as an API for use by other applications/devices.

Obviously I want to keep things simple and avoid duplication, so how should I approach this? Should I use a single URI for both user login and api login? If so how should I handle the different requirements - inform the user of success or failure with a flash/redirect and return a JSON object to the API client?

greut · Accepted Answer · 2012-01-13 17:50:01Z

2

Use a form based login for your users (e.g. Devise)

and an OAuth based login for the API (for rails oauth2_provider)

You cannot avoid duplication here, not if you want to do things correctly. Mainly because your API is stateless and your users are stateful (the cookies!).

edited Jan 13, 2012 at 17:50

answered Jan 12, 2012 at 17:41

greut

4,4031 gold badge32 silver badges49 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Undistraction Over a year ago

But what if I use token-based authentication? Would that mean there was a way of unifying the User login and API authentication?

greut Over a year ago

oAuth is a bit more than an access_token only, you have to sign every request. The spec says that you can obtain an access_token sending your password, but it's not recommended. tools.ietf.org/html/draft-ietf-oauth-v2-22#page-14 Rails is full of gems doing all those things already, you won't have much to do, regarding duplication.

Collectives™ on Stack Overflow

Designing Rails Authentication API

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related