如果用户未使用我的Web（导轨）应用程序（例如使用API​​），我该如何对他们进行身份验证

Question

I have created a Rails (3.2) application that uses the OmniAuth gem to provide OAuth authentication. Users can log into the site using their Twitter, Facebook or Google credentials, pretty bog-standard functionality.

I now want to make the data available via an API so it can be consumed outside of my web application, however, users would still have to login to be able to access their data. How do I do this in my Rails APP? And what would the user have to do to be able to call this?

UPDATE Some people are suggesting "alternative" authentication methods, but I am wondering if I cannot use the same OAuth credentials I already have for them. I don't want them to have to provide another username/pwd, I want them to be able to use their Twitter, Facebook or Google Identities as they do when they use the WebUI.

Answer 1

authenticate_with_http_basic (or digest if you like) might work for you, called from a before filter in the controller.

You can test with curl, using the --user parameter.

Here's a good thread on the topic: In Ruby on Rails, what does authenticate_with_http_basic do?

Answer 2

Devise has the feature token authentication which is what you are looking for.

Also visit http://zyphmartin.com/blog/simple-auth-token-example-with-devise