Devise_token_auth 和 Devise 使用用户名和电子邮件登录

Question

I continuously get errors when trying to add token authentication to my existing rails application and it's stemming from the devise authentication_keys. In my rails 4 app I allow users to login with either a username or email and I'd like to provide the same functionality for the API.

The error I'm getting when logging in from the API is as follows

Started POST "/api/v1/auth/sign_in" for 127.0.0.1 at 2016-04-19 23:40:26 -0400
Processing by DeviseTokenAuth::SessionsController#create as JSON
Parameters: {"login"=>"email@example.com", "password"=>"[FILTERED]", "session"=>{"login"=>"email@example.com", "password"=>"[FILTERED]"}}
Can't verify CSRF token authenticity
Geokit is using the domain: localhost
User Load (1.3ms)  SELECT  "users".* FROM "users" WHERE (login = 'email@example.com' AND provider='email')  ORDER BY "users"."id" ASC LIMIT 1
SQLite3::SQLException: no such column: login: SELECT  "users".* FROM "users" WHERE (login = 'email@example.com' AND provider='email')  ORDER BY "users"."id" ASC LIMIT 1
Completed 500 Internal Server Error in 5ms

SQLite3::SQLException - no such column: login:

The code for the user model is below. The problem is stemming from the User load as it is not converting the login parameter to search via the email (or username). But the code below works totally fine for regular devise logins.

#User.rb
devise :database_authenticatable, :registerable, :confirmable,
     :recoverable, :rememberable, :trackable, :validatable, :authentication_keys => [:login]
include DeviseTokenAuth::Concerns::User

def self.find_for_database_authentication(warden_conditions)
  conditions = warden_conditions.dup
  if login = conditions.delete(:login)
    where(conditions.to_h).where(['lower(username) = :value OR lower(email) = :value', { :value => login.downcase }]).first
  else
    where(conditions.to_h).first
  end
end

Thanks for any help or guidance!

EDIT When sending the params as email and password there is also an error.

Processing by DeviseTokenAuth::SessionsController#create as JSON
Parameters: {"email"=>"email@example.com", "password"=>"[FILTERED]", "session"=>{"email"=>"email@example.com", "password"=>"[FILTERED]"}}
Can't verify CSRF token authenticity
Unpermitted parameters: email, format, session
Completed 401 Unauthorized in 49ms (Views: 0.3ms | ActiveRecord: 0.0ms | Solr: 0.0ms)

Answer 1

1. From the Devise doc , you need to do the following:

   • app/models/user.rb

      attr_accessor :login

   • config/initializers/devise.rb

      Devise.setup do |config| config.authentication_keys = [:login] config.case_insensitive_keys = [:login] end

2. devise_token_auth is unmaintained ( cf unmerged PR ) and therefore out-of-sync with Devise, which is why you need to override SessionsController:

   • config/routes.rb

      Rails.application.routes.draw do namespace :api do scope module: :v4 do mount_devise_token_auth_for "User", at: "auth", controllers: { sessions: "api/v4/devise_token_auth/sessions" } end end end

   • app/controllers/api/v4/devise_token_auth/sessions_controller.rb

      module Api module V4 module DeviseTokenAuth class SessionsController < ::DeviseTokenAuth::SessionsController def create # Check field = (resource_params.keys.map(&:to_sym) & resource_class.authentication_keys).first @resource = nil if field q_value = resource_params[field] if resource_class.case_insensitive_keys.include?(field) q_value.downcase! end q = "#{field.to_s} = ? AND provider='email'" if ActiveRecord::Base.connection.adapter_name.downcase.starts_with? "mysql" q = "BINARY " + q end # LOG IN BY EMAIL AND USERNAME if field == :login @resource = resource_class.where("email = ? OR username = ?", q_value, q_value).first else @resource = resource_class.where(q, q_value).first end # LOG IN BY EMAIL AND USERNAME END end if @resource && valid_params?(field, q_value) && (!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?) valid_password = @resource.valid_password?(resource_params[:password]) if (@resource.respond_to?(:valid_for_authentication?) && !@resource.valid_for_authentication? { valid_password }) || !valid_password render_create_error_bad_credentials return end # create client id @client_id = SecureRandom.urlsafe_base64(nil, false) @token = SecureRandom.urlsafe_base64(nil, false) @resource.tokens[@client_id] = { token: BCrypt::Password.create(@token), expiry: (Time.now + ::DeviseTokenAuth.token_lifespan).to_i } @resource.save sign_in(:user, @resource, store: false, bypass: false) yield @resource if block_given? render_create_success elsif @resource && !(!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?) render_create_error_not_confirmed else render_create_error_bad_credentials end end end end end end

3. Test example

   resource "User sign in" do let(:user) { build(:user) } before(:each) do user.create_new_auth_token end post "/api/auth/sign_in" do parameter :email, "Email address" parameter :password, "Password for user" it "fails with incorrect login and password" do do_request(login: "user.does.not@exist.com", password: "wrong_password") expect(status).to eq(401) expect(JSON.parse(response_body)["errors"]) .to include("Invalid login credentials. Please try again.") end it "logs in with correct username and password" do user.save! do_request(login: user.username, password: user.password) expect(status).to eq(200) expect(JSON.parse(response_body)["data"]["email"]).to include(user.email) end it "logs in with correct email and password" do user.save! do_request(login: user.email, password: user.password) expect(status).to eq(200) expect(JSON.parse(response_body)["data"]["email"]).to include(user.email) end end end

Answer 2

Explanation:

The method find_for_database_authentication used for the authentication can be found in Devise's database_authenticable.rb file, which hosts the DatabaseAuthenticatable module.

This is responsible for authenticating your resource while using Devise.

This method is what you are overwriting in your User model, and this is why your authentication action is working fine when you use Devise .

On the other hand, when you try to authenticate a resource with devise_token_auth , You are hitting the create action of the SessionsController < DeviseTokenAuth::ApplicationController .

This can be seen from your error trace:

Started POST "/api/v1/auth/sign_in" for 127.0.0.1 at 2016-04-19 23:40:26 -0400
Processing by DeviseTokenAuth::SessionsController#create as JSON

What this action does, as can be seen from the file here , is that it looks at the params you are sending, and builds key=>value pairs from those, and then query the database with the keys.

So, in essence, when you send a param as:

{"login"=>"email@example.com", "password"=>"[FILTERED]"}

Your controller will basically go into the database and look for a row with login equal email@example.com , etc..

Problem:

Unfortunately, you have no column login in your database, what you have is email , ( remember that was why you were over-riding the devise's find_for_database_authentication method in your user model =>

where(conditions.to_h).where(['lower(username) = :value OR lower(email) = :value', { :value => login.downcase }]).first

).

That is why you see the error you have in your error trace:

SQLite3::SQLException - no such column: login:

Solution:

So, one very simple thing you can do is that when you are sending a param for authentication by the auth_token , send it as email and password

{"email"=>"email@example.com", "password"=>"[FILTERED]"}

and not as login and password

Hope this is clear.

PS: You also will not want session validation when using token, as mentioned by Shadow above, so you might want to add the following to your base controller: protect_from_forgery with: :null_session, if: Proc.new { |c| c.request.format == 'application/json' } protect_from_forgery with: :null_session, if: Proc.new { |c| c.request.format == 'application/json' } But this does not have to do with your reported issue.

Edit:

This is the permited params method:

def resource_params
  params.permit(*params_for_resource(:sign_in))
end

So, you will have to send params inside a "sign_in" key as follow:

{"sign_in" => {"email"=>"email@example.com", "password"=>"[FILTERED]"}}