测试API用户身份验证的最佳方法？

Question

I'm building an API with Ruby on Rails and (attempting to) build user auth with a gem called Devise Token Auth. But I'm uncertain about the best way to validate / authenticate a user before each controller action.

I know of the before_action :authenitcate_user! call but it thinks my users aren't signed in since I'm making calls from an external client.

Do I need to pass other arguments along with my requests that I'm not thinking of? Like a token or session id?

Answer 1

try simple_token_authentication https://github.com/gonzalo-bulnes/simple_token_authentication works with Devise and is easy to integrate. You just need to send the user authentication token and email, to perform the authentication.

Answer 2

If you are building a lightweight API app I would consider using Knock .

Devise is a great solution for traditional apps where you need a full authentication solution with signups, password editing etc. But it is designed around session based authentication and the codebase is somewhat of a monster due to the crazy amount of customizations available - with token based auth you will only be using about 1% of it.

A basic setup would be:

class ApplicationController < ActionController::API
  include Knock::Authenticable
  prepend_before_action :authenticate_user
end

Now if we send a request without a valid Authorization: Bearer SOME_TOKEN header Knock will return a 401 - Unauthorized response.

We can test it like so:

class UsersControllerTest < ActionDispatch::IntegrationTest
  def token
    Knock::AuthToken.new(payload: { sub: users(:one).id }).token
  end

  it 'does not allow an unauthenicated request' do
    get users_path
    assert_response :unauthorized
  end

  it 'allow an authenicated request' do
    get users_path, headers: { authorization: "Bearer #{token}" }
    assert_response :success
  end
end