Use the Simplest Authentication System
Explore how to apply the simplest authentication methods for Rails API endpoints, including cookie-based authentication, HTTP Basic Auth, and token-based API keys using a database table. Understand why simplifying authentication enhances security and learn to create and test a token system for easier management and auditing.
We'll cover the following...
Many developers, upon hearing “API” and “authentication,” will jump to JSON Web Tokens, JWT, or OAuth. Be careful here. If our API is simply a JSON endpoint for consumption by our front end, we can transparently use the existing cookie-based authentication we already have. Remember, the more authentication mechanisms we support, the more vulnerable our app is to security issues because each mechanism is an attack vector.
If our API is being consumed internally, there are two other mechanisms we should consider before adopting something complex like JWT or OAuth, especially if our API does not require a sophisticated set of authorizations. The first is HTTP Basic Auth, which is a name and a password.
Rails provides a http_basic_authenticate_with method that we can call in our controllers ...