CODEWITHSUNDEEP
ruby-on-railsapirestcordovaember.js
DrCorduroy
DrCorduroy

Reputation: 92

Rails API Authentication From Multiple Devices

I have a restful API that is going to accessed by multiple organizations. Their data is going to always be separate. I am using rails 4.0, emberjs, and phonegap. There are going to multiple devices accessing the API for a single organization at any point in time.

My question is how to properly design my API with these multiple organizations and devices in mind.

Current Solution:

The user must authenticate with the organization name and password. This is done over HTTPS with basic auth. After that the user is given a token that ember stores and is used for each subsequent request. Since there are multiple devices multiple API tokens can be associated with an organization. Rails uses the token to get the organization id with every request so the url /members only outputs the members related to the organization the token belows to. Thoughts on this?

Requiring every restful resource to be started with organization/id/resource seemed insecure and unwieldy to me so that is why I chose my current solution.

A Better Way?

What is a better way of doing this? Should I give each organization a subdomain and pass that back along with the token and use the token only for security and the subdomain for identifying the organization? Or should I just stick with organization/id/resource?

Upvotes: 2

Views: 711

Answers (1)

Dmitry
Dmitry

Reputation: 191

You are right, the token itself should not contain any "organization" part - it's insecure, as well as adding subdomain in the way you've proposed.

Instead of that you can add Organization field to the Token object (or table - depends on how you track tokens). Once you received the token you're able to get the Organization.

Upvotes: 1

Related Questions