Share auth with Rails app? (Devise authentication)

[Ernest Surudo]

Goliath looks interesting, and I'm looking to use it for a small part of a mobile API that will be hit often (so it needs to be fast).

Once a user creates a session via the API (username/password), he is handed back a token, and uses that for subsequent requests in the Rails API.

I'm using Devise for authentication on the Rails side, so the auth token is stored in the DB. I'm looking to avoid the DB altogether for this part of the API (store the data in Redis instead, probably), which complicates things a bit. I'm open to other options, though.

I know this is vague, but does anyone have any experience with sharing this auth scheme with Goliath? Pointing me in the right direction, perhaps?

[Ilya Grigorik]

You obviously need to run the API server on the same origin to get the cookie. Once you have the cookie.. you'll have to reverse-engineer and validate it. 

ig

--
You received this message because you are subscribed to the Google Groups "Goliath.io" group.
To unsubscribe from this group and stop receiving emails from it, send an email to goliath-io+...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[Ernest Surudo]

I'm not using cookies, but instead store the auth token in the request headers. So I'll need a way to validate the token.

I'm considering adding some observers around devise, so that during log in, I write the token out to a shared Redis DB that I can then validate with on the Goliath side. Seems a bit hacky, though, so I was wondering if there are some existing best practices to follow.

Ernest

You received this message because you are subscribed to a topic in the Google Groups "Goliath.io" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/goliath-io/b_6Yq7GZnI0/unsubscribe.
To unsubscribe from this group and all its topics, send an email to goliath-io+...@googlegroups.com.

[Ilya Grigorik]

You use a custom HTTP header to manually communicate your auth-token? Why?
That's what cookies are for..

Re, shared token: that doesn't sound "hacky" .. if that's what you need to
validate the token.

ig

[Ernest Surudo]

It's an API for a mobile app, and I felt passing the auth token along in the header was cleaner. It's not a custom HTTP header, btw; IIRC it's pretty standard to pass the token in an "Authorization" header like so: "Authorization: Token token="TOKENVALUE".

E