#352 Securing an API

May 23, 2012 | 7 minutes | Security, APIs

There are many approaches to locking down an API. Here I start off with HTTP Basic authentication then move on to generating a unique token which can be passed through a URL parameter or HTTP header.

Click to Play Video ▶

Download:
source codeProject Files in Zip (95.7 KB)
mp4Full Size H.264 Video (20 MB)
m4vSmaller H.264 Video (9.66 MB)
webmFull Size VP8 Video (7.81 MB)
ogvFull Size Theora Video (25.9 MB)

Browse Source Code

Resources

          terminal
        
rails g model api_key access_token
curl http://localhost:3000/api/products -I
curl http://localhost:3000/api/products -u 'admin:secret'
curl 'http://localhost:3000/api/products?access_token=123' -I
curl http://localhost:3000/api/products -H 'Authorization: Token token="c576f0136149a2e2d9127b3901015545"'

          api/v1/products_controller.rb
        
# http_basic_authenticate_with name: "admin", password: "secret"
before_filter :restrict_access

private

# def restrict_access
#   api_key = ApiKey.find_by_access_token(params[:access_token])
#   head :unauthorized unless api_key
# end

def restrict_access
  authenticate_or_request_with_http_token do |token, options|
    ApiKey.exists?(access_token: token)
  end
end

          models/api_key.rb
        
before_create :generate_access_token

private

def generate_access_token
  begin
    self.access_token = SecureRandom.hex
  end while self.class.exists?(access_token: access_token)
end