Skip to Content Skip to Search

HTTP Token authentication ↑

Simple Token example ↑

class PostsController < ApplicationController TOKEN = "secret" before_action :authenticate, except: [ :index ] def index render plain: "Everyone can see me!" end def edit render plain: "I'm only accessible if you know the password" end private def authenticate authenticate_or_request_with_http_token do |token, options| # Compare the tokens in a time-constant manner, to mitigate # timing attacks. ActiveSupport::SecurityUtils.secure_compare(token, TOKEN) end end end

Here is a more advanced Token example where only Atom feeds and the XML API are protected by HTTP token authentication. The regular HTML interface is protected by a session approach:

class ApplicationController < ActionController::Base before_action :set_account, :authenticate private def set_account @account = Account.find_by(url_name: request.subdomains.first) end def authenticate case request.format when Mime[:xml], Mime[:atom] if user = authenticate_with_http_token { |t, o| @account.users.authenticate(t, o) } @current_user = user else request_http_token_authentication end else if session_authenticated? @current_user = @account.users.find(session[:authenticated][:user_id]) else redirect_to(login_url) and return false end end end end

In your integration tests, you can do something like this:

def test_access_granted_from_xml authorization = ActionController::HttpAuthentication::Token.encode_credentials(users(:dhh).token) get "/notes/1.xml", headers: { 'HTTP_AUTHORIZATION' => authorization } assert_equal 200, status end

On shared hosts, Apache sometimes doesn’t pass authentication headers to FCGI instances. If your environment matches this description and you cannot authenticate, try this rule in your Apache setup:

RewriteRule ^(.*)$ dispatch.fcgi [E=X-HTTP_AUTHORIZATION:%{HTTP:Authorization},QSA,L]
Namespace
Methods
A
E
P
R
T

Constants

AUTHN_PAIR_DELIMITERS = /(?:,|;|\t)/
 
TOKEN_KEY = "token="
 
TOKEN_REGEX = /^(Token|Bearer)\s+/
 

Instance Public methods

authenticate(controller, &login_procedure)

If token Authorization header is present, call the login procedure with the present token and options.

Returns the return value of login_procedure if a token is found. Returns nil if no token is found.

Parameters ↑

  • controller - ActionController::Base instance for the current request.

  • login_procedure - Proc to call if a token is present. The Proc should take two arguments:

    authenticate(controller) { |token, options| ... }

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/http_authentication.rb, line 472 def authenticate(controller, &login_procedure) token, options = token_and_options(controller.request) unless token.blank? login_procedure.call(token, options) end end

authentication_request(controller, realm, message = nil)

Sets a WWW-Authenticate header to let the client know a token is desired.

Returns nothing.

Parameters ↑

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/http_authentication.rb, line 555 def authentication_request(controller, realm, message = nil) message ||= "HTTP Token: Access denied.\n" controller.headers["WWW-Authenticate"] = %(Token realm="#{realm.tr('"', "")}") controller.__send__ :render, plain: message, status: :unauthorized end

encode_credentials(token, options = {})

Encodes the given token and options into an Authorization header value.

Returns String.

Parameters ↑

  • token - String token.

  • options - Optional Hash of the options.

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/http_authentication.rb, line 539 def encode_credentials(token, options = {}) values = ["#{TOKEN_KEY}#{token.to_s.inspect}"] + options.map do |key, value| "#{key}=#{value.to_s.inspect}" end "Token #{values * ", "}" end

params_array_from(raw_params)

Takes raw_params and turns it into an array of parameters.

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/http_authentication.rb, line 507 def params_array_from(raw_params) raw_params.map { |param| param.split %r/=(.+)?/ } end

raw_params(auth)

This method takes an authorization body and splits up the key-value pairs by the standardized :, ;, or \t delimiters defined in AUTHN_PAIR_DELIMITERS.

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/http_authentication.rb, line 519 def raw_params(auth) _raw_params = auth.sub(TOKEN_REGEX, "").split(AUTHN_PAIR_DELIMITERS).map(&:strip) _raw_params.reject!(&:empty?) if !_raw_params.first&.start_with?(TOKEN_KEY) _raw_params[0] = "#{TOKEN_KEY}#{_raw_params.first}" end _raw_params end

rewrite_param_values(array_params)

This removes the " characters wrapping the value.

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/http_authentication.rb, line 512 def rewrite_param_values(array_params) array_params.each { |param| (param[1] || +"").gsub! %r/^"|"$/, "" } end

token_and_options(request)

Parses the token and options out of the token Authorization header. The value for the Authorization header is expected to have the prefix "Token" or "Bearer". If the header looks like this:

Authorization: Token token="abc", nonce="def"

Then the returned token is "abc", and the options are {nonce: "def"}.

Returns an Array of [String, Hash] if a token is present. Returns nil if no token is found.

Parameters ↑

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/http_authentication.rb, line 494 def token_and_options(request) authorization_request = request.authorization.to_s if authorization_request[TOKEN_REGEX] params = token_params_from authorization_request [params.shift[1], Hash[params].with_indifferent_access] end end

token_params_from(auth)

Source: show | on GitHub 

# File actionpack/lib/action_controller/metal/http_authentication.rb, line 502 def token_params_from(auth) rewrite_param_values params_array_from raw_params auth end