如何检查用户登录并让 Backbone 获取/发布到 Rails 后端？ (+设计)

Question

I have a Rails backend which uses Devise, and a decoupled Backbone frontend on a separate site.

I'd like to have Backbone make GET calls to the separate Rails server to my Items resource. Based on:

1. If user is not logged in, make the GET call with some default parameters
2. If user is logged in, make the GET call with user.attribute as a parameter

I also want to allow the user to POST to edit account details (eg, user.attribute ).

---

How do I:

1. Check if user is logged in / allow user to log in from Backbone or separate Rails site
2. Pull the logged-in user's attribute
3. Verify authenticity when POST ing

TL;DR How to share a session between Devise and Backbone? How to make calls using that session? Is session sharing the right structure?

I've seen this answer and my understanding thus far is:

• Backbone passes user's login information in a GET to Devise /signin
• Rails sends a session cookie back and other stuff that I somehow save in Backbone somewhere
• Each time Backbone makes GET or POST calls, I use that session cookie and other stuff? and Rails/Devise verifies it somehow

Thanks in advance -

Answer 1

It's best for the front end to initially assume that the user is logged in, make the request, and for the server to fail the request back with a 401, 403, or similar response code, indicating to the front end that the users is not authenticated. The front end should then make whatever calls are necessary to authenticate the user, and then reissue the original request(s) for the user as appropriate.