How to make rails 3 work as a backend for mobile applications with session_id support in a request?

Question

I am trying to create rails 3 for a mobile application. However, I am new to creating rails 3 applications.

Users will need a session on the server, but I do not have support for regular cookies, so I will need to send session_id along with each request.

What authentication system should be used in rails 3, is there a stone?

I read that in rails 2 it was possible to set session_id from the url, but this function has been removed from rails 3 due to security issues. It's true? If there is a way to do this, I am very interested, despite possible security holes.

Answer 1

Update

A small update: Devess no longer has authentication_token , as its implementation is considered too uncertain. A good alternative is Brian Auton's suggestion .

A summary of his method is that it generates authentication_and_and_and_and_and_sec in a separate model. Then you perform authentication, sending both your key and secret, if a match is found, you are temporarily logged in as a user.

In your application controller, it looks like this:

 class ApplicationController < ActionController::Base before_filter :authenticate_from_token protected def authenticate_from_token if current_token.try :authenticatable sign_in token.authenticatable, store: false end end def current_token AuthenticationToken.find_authenticated({ secret: (params[:secret] || request.headers[:secret]), secret_id: (params[:secret_id] || request.headers[:secret_id]), }) end end 

authenticatable token in this case is a user model or any other thing that has been authenticated (tokens are polymorphic). As you can see, it can easily be made to work with Devise.

I really like this method and it implemented it in a recent API. Read it on your website.

Old answer

Deprecated answer saved for links to older versions of Devise: Devise has an authentication_token column that I can use to authenticate the user. I could have a login API method, which I will also send by username + password, and then return it and save it to sign all my other calls locally. This is mainly a cookie system, but one of them is directly supported by Devise.

In addition to this, I could generate a token either on every call, or on every session.

Answer 2

I usually use HTTP Digest authentication to solve this problem. Most Rails authentication plugins (such as Authlogic, possibly Devise) will support HTTP Basic or Digest authentication, albeit a plugin. This way you don't have to worry about expired cookies, etc.

You can also pass the api_key parameter instead of the session id.

In many cases, I used the api key as the HTTP Basic username. This gives clean URLs and no session authentication.

The security issue you are probably talking about is the query subroutine across multiple sites . This is really a real problem. Its why you hide actions with side effects (create, update, destroy) behind forms using the CSRF token. Otherwise, the malicious link may perform unintended actions on the site to which you have already authenticated, without having to know your credentials.

Until your API key is easily detected by someone in an automatic way, the risk should be minimal.