CODEWITHSUNDEEP
ruby-on-railsapisessionauthentication
Gregir
Gregir

Reputation: 1574

How to authenticate Rails application using token from 3rd party API?

I have a Rails application that make several user-specific calls to a third-party API. They interact with a lot of data in the course of filling out a survey, and their progress is stored in HTML5 localStorage until they reach the end of the survey and the data is saved in a local database & localStorage cleared.

The API calls require a token tacked onto the end as an "auth=" parameter. Right now, I have the user log into my app with their username and password to that service, POST those credentials to the "sessions" call of that API, and get a token back in JSON. I store that token in a variable in the controller, and use it to make the successive API calls and present the user's data in my app, etc. etc.

I've learned quite a bit about Rails, but next to nothing about sessions or authentication. Generally speaking, is there anything more I need to do for this to be a secure scenario? I feel like I'm missing something.

Upvotes: 0

Views: 1082

Answers (1)

AJcodez
AJcodez

Reputation: 34234

Assuming the user's username / password combination for the 3rd party service doesn't hit your servers, seems OK to me.

If your servers see the user's credentials, that's not particularly cool. Instead use OAuth to get 3rd party sign in, and use the token to make requests on behalf of the user. You can usually keep the whole session on the client if you want to avoid saving users to the database.

Storing progress in localstorage sounds fine btw. To preserve values you can have the pages of the form be tabs (so hide the previous form, not a new page) and use:

autocomplete="on"

to signify that the values should be restored to what they were. Try that before writing code to save things to localstorage.

Upvotes: 1

Related Questions