Ruby-on-rails 设计 API 认证
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/7614798/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Devise API authentication
提问by Xiaotian Guo
I am working on a rails web application that also provides JSON based API for mobile devices . mobile clients are expected to first obtain a token with (email/pass), then clients will make subsequential API calls with the token.
我正在开发一个 Rails Web 应用程序，该应用程序还为移动设备提供基于 JSON 的 API。预计移动客户端首先使用 (email/pass) 获取令牌，然后客户端将使用该令牌进行后续 API 调用。
I am pretty new to Devise, and I am looking for a Devise API look like authenticate(email, pass)and expect it to return true/false, then based on that I will either create and hand back the token or return a decline message. but seems Devise doesn't provide something like this.
我对 Devise 很陌生，我正在寻找一个 Devise API 看起来像authenticate(email, pass)并期望它返回 true/false，然后基于此我将创建并交回令牌或返回拒绝消息。但似乎 Devise 没有提供这样的东西。
I am aware that Devise 1.3 provides JSON based auth, but that's a bit different from what I need - I need to generate token and handle back to client, then after that auth is done using the token instead.
我知道 Devise 1.3 提供基于 JSON 的身份验证，但这与我需要的有点不同 - 我需要生成令牌并处理回客户端，然后在使用令牌完成身份验证之后。
Can someone please give some pointers?
有人可以指点一下吗？
回答by Jesse Wolgamott
There is a devise configuration called :token_authenticatable. So if you add that to the devise method in your "user", then you can authenticate in your API just by calling
有一个名为:token_authenticatable. 因此，如果您将其添加到“用户”中的设计方法中，那么您只需调用即可在您的 API 中进行身份验证
"/api/v1/recipes?qs=sweet&auth_token=[@user.auth_token]"
You'll probably want this in your user as well:
您可能也希望在您的用户中使用它：
before_save :ensure_authentication_token
UPDATE(with API authorization code)
UPDATE（带API授权码）
The method you're looking for are:
您正在寻找的方法是：
resource = User.find_for_database_authentication(:login=>params[:user_login][:login])
resource.valid_password?(params[:user_login][:password])
回答by janders223
I would recommend reading through the Devise Wiki, as Devise natively supports token authentication as one of it's modules. I have not personally worked with token authentication in Devise, but Brandon Martin has an example token authentication example here.
我建议阅读Devise Wiki，因为 Devise 本身支持令牌身份验证作为它的模块之一。我没有亲自在 Devise 中使用令牌身份验证，但 Brandon Martin 有一个示例令牌身份验证示例here。
回答by chris_b
Devise is based on Warden, an authentification middleware for Rack.
Devise 基于 Warden，这是 Rack 的身份验证中间件。
If you need to implement your own (alternative) way to authenticate a user, you should have a look at Warden in combination with the strategies that ship with Devise: https://github.com/plataformatec/devise/tree/master/lib/devise/strategies
如果您需要实现自己的（替代）方式来验证用户身份，您应该结合 Devise 附带的策略查看 Warden：https: //github.com/plataformatec/devise/tree/master/lib /设计/策略
回答by Mark Swardstrom
If token auth just isn't what you want to do, you can also return a cookie and have the client include the cookie in the request header. It works very similar to the web sessions controller.
如果令牌身份验证不是您想要做的，您还可以返回一个 cookie 并让客户端在请求标头中包含该 cookie。它的工作原理与 Web 会话控制器非常相似。
In an API sessions controller
在 API 会话控制器中
class Api::V1::SessionsController < Devise::SessionsController
skip_before_action :authenticate_user!
skip_before_action :verify_authenticity_token
def create
warden.authenticate!(:scope => :user)
render :json => current_user
end
end
In Routes
在路线中
namespace :api, :defaults => { :format => 'json' } do
namespace :v1 do
resource :account, :only => :show
devise_scope :user do
post :sessions, :to => 'sessions#create'
delete :session, :to => 'sessions#destroy'
end
end
end
Then you can do this sort of thing (examples are using HTTPie)
然后你可以做这种事情（例子是使用HTTPie）
http -f POST localhost:3000/api/v1/sessions user[email][email protected] user[password]=passw0rd
The response headers will have a session in the Set-Cookie header. Put the value of this in subsequent requests.
响应标头将在 Set-Cookie 标头中有一个会话。将 this 的值放在后续请求中。
http localhost:3000/api/v1/restricted_things/1 'Cookie:_my_site_session=<sessionstring>; path=/; HttpOnly'
