传递access_token进行API调用的最佳实践是什么

Question

I have developed a Rails Application which is using Oauth 2 for Authorization . Currently for accessing API calls i am passing access_token as URL parameter , I heard that token can also be passed as Header. Which is the best practice for passing access_token and why?

I am using Devise + Doorkeeper for Oauth support.

Please give me some suggesstion..

Answer 1

As header you can make like this in controller:

before_filter :authenticate

protected

def current_user
  @current_user
end

def authenticate
  token = request.env["HTTP_ACCESS_TOKEN"]
  @current_user = User.where(authentication_token: token).first if token.present?
  unless token && current_user.present?
    #error handling goes here.
  end
end

Answer 2

It's common to see access_token present in Headers. Look: What are headers for? They are for the metainformation about the request. And accesstoken, undoubtedly, is metainformation.

I'm not sure if my answer is complete, there could be some extra pitfalls I don't know about. Correct me if I'm wrong.