Use of cookie-free utilities without cookies

Question

I have a Rails working site that uses devise to manage users. To manage the session, I use devose rememberable , which stores and retrieves encrypted authentication information from the user's cookie.

I am implementing a widget with several photos that uses flash. Flash does not support sending cookies along with requests. This is a problem with several multi-user flash + javascript libraries, so fixing this is probably not possible.

So my question is: can I successfully authenticate to develop / remember without using cookies? And if so, how?

More details

When developing / remembering, it depends on the remember_token value inside the cookie. If I could fool Rails into thinking that the value was provided as a cookie (for example, request.cookies['remember_token'] = '...' ), my problem will be solved. Devise / rememberable will find the correct value there, unpack and successfully authenticate. However, the request.cookies hash is apparently read-only. Writing to the hash is silently ignored. Example (debug console from incoming POST request):

 >> request.cookies['remember_token'] = 'a string' => "a string" >> request.cookies['remember_token'] => nil >> request.cookies => {} 

I am using (or trying to use) the FancyUpload v3 widget.

Answer 1

How to override Devise a bit?

Based on Devise 1.2.rc, something like this should work:

 module Devise module Strategies class Rememberable def remember_cookie # your code to get the hashed value from the request end end end end 

Alternatively, you can add a new (subclassical) strategy:

 module Devise module Strategies class RememberableParameter < Rememberable def remember_cookie # your code to get the hashed value from the request end end end end Warden::Strategies.add(:rememberable_parameter, Devise::Strategies::Rememberable) 

Or look at the Authenticatable token:

Token Authenticatable: Subscribes to a user based on an authentication token (also known as an “access token”). The token can be specified either by query string or by Basic HTTP authentication

More on this here: https://github.com/plataformatec/devise/blob/master/lib/devise/models/token_authenticatable.rb

Good luck