#352 Securing an API

May 23, 2012 | 7 minutes | Security, APIs

There are many approaches to locking down an API. Here I start off with HTTP Basic authentication then move on to generating a unique token which can be passed through a URL parameter or HTTP header.

Click to Play Video ▶

Download:
source codeProject Files in Zip (95.7 KB)
mp4Full Size H.264 Video (20 MB)
m4vSmaller H.264 Video (9.66 MB)
webmFull Size VP8 Video (7.81 MB)
ogvFull Size Theora Video (25.9 MB)

Daniel Bruns over 12 years ago

How do you autocomple the "restrict_access". It looked like it cycled through a few options...

Antek Drzewiecki over 12 years ago

Hi Ryan, lately I've seen a lots of development railscasts for rails API's. What are the best practices to test API's and versions? Because you don't want to break anything down if you implement new features, change the json format later on. What i would like to know is how you guys test your json api's input and output and even with versioning. Maybe this would be a good idea for a railscast.

Thanks

Zolzaya Erdenebaatar over 12 years ago

Hi Anket, I have a same problem over here.

Antek Drzewiecki over 12 years ago

Hey Zolzaya,
I did some research myself. I think i will try to split my controller and response tests with Capibara gem. What I test in my controllers are the controller logic. I still need to get started with testing on my json responses. Ill give you a update...

          Ruby
        
require 'spec_helper'
module Api
  module V1
    describe UserSessionsController do
      describe "authenticate" do
        it "authenticates correctly" do         
          user = FactoryGirl.create(:user)          
          post :create, :login => user.email, :password => user.password, :format => "json"    
          response.should be_success
        end
      
      describe "fail authentication" do 
      end
      
      describe "logout" do 
      end
      
      
    end
  end
end

One thing i have to use :format => "json" to get json responses, it would be great if it went automatically.

One more thing check RABL git how to test your RABL responses.

https://github.com/nesquena/rabl/wiki/Testing-with-rspec

Here you go mate ;)

Antek Drzewiecki over 12 years ago

In my previous post, forget about Capibara.

I got a sample how you could test some controllers..
In my setup I use; factorygirl and RSpec.

          Ruby
        
require 'spec_helper'
module Api
  module V1
    describe UserSessionsController do
      render_views
      describe "authenticate" do
        it "authenticates correctly" do         
          user = FactoryGirl.create(:user)          
          post :create, :email => user.email, :password => user.password, :format => "json"  
          user.reload
          response.cookies['user_token'].should eq(user.user_token)
          response.should be_success
          body = JSON.parse(response.body)
          body['id'].should eq(user.id)
          body['email'].should eq(user.email)
          body['user_token'].should eq(user.user_token)
          body['password'].should equal nil
          body['profile'].should_not be nil
          
        end
        it "should return a json user"
          user = FactoryGirl.create(:user) #this user
          @request.cookies['user_token'] = user.user_token #  if you need an auth cookie..
          get :show, :id => user.id, :format => "json"
          response.should be_success
          body = JSON.parse(response.body)
          body.should have(1).user #test if only one root object is returned (sometimes you dont want to have a json root..)
          body[0].should have_key("user") #test root key...
          body[0]['user'].should have_key("id")
          body[0]['user'].should have_key("email")
          body[0]['user'].should have_key("friends")
          body[0]['user'].should have_key("profile") #test if the user has an associated profile
          body[0]['user'].should have_key("updated_at")
          body[0]['user']['profile'].should have(1).profile # test that the user returns only 1 profile.
          body[0]['user']['friends'].should have(3).friends #test that the user has 3 friends
        end
      end
    end
  end
end

I hope this helps you..

ミューズ over 12 years ago

It would be great to make a screencast about rate limiting.

Luiz Eduardo Kowalski over 12 years ago

that would be awesome

Drazen Mokic over 12 years ago

If every API users has a API_KEY or Token, you can have a column like 'requests_count' and increment it with each request. When you reach lets say 500, you can return a 500 or something and have rake tasks reset the count after 24 hours or so.

amnesia7 over 12 years ago

Very useful screencast Ryan.

I'm using a generate_access_token in my User model to create an access_token for each user so that my app can do "Remember Me" using a cookie (so they don't need to login again) as per screencast #274.

Would I use this same access_token field for the user to be able to call my API?
Can you see any issue in doing that?
Or should they be different?

Christoph Bünte over 12 years ago

Try rack api throttling with a rack middleware. I forked it to limit throttling to a certain path: https://github.com/christoph-buente/api-throttling

amnesia7 over 12 years ago

...but would I use the access_token field to identify the user calling the API?

Matthew Ford over 12 years ago

authenticate_or_request_with_http_token did not work for me, use authenticate_with_http_token (http://apidock.com/rails/v3.2.3/ActionController/HttpAuthentication/Token/ControllerMethods/authenticate_with_http_token)

Kavinder Dhaliwal about 12 years ago

Great cast, really helped me secure my API. One question, how can I pass a token and userid with a request for authenticate_or_request_with_http_token so I can always match a token to a user?

baruchlubinsky about 12 years ago

I initial had some trouble implementing this together with Mongoid. It turned out that the problem was in the mongoid.yml configuration file. When I changed

host: localhost

host: 0.0.0.0

Everything worked properly. I guess this is because having a proxy server messes with the meaning of localhost.

Ryan Tyler about 12 years ago

@Matthew Ford(Im sure you found this by now)

For anyone who followed the rails api gem cast you might have problems adding in the:

"authenticate_or_request_with_http_token"

To use this you will need to add this line:

include ActionController::HttpAuthentication::Token::ControllerMethods

Michael Schaarschmidt over 11 years ago

Please could you give an example of an activeresource model, which calls a protected RESTapi? With curl all is fine, but how can I deliver the token with a activeresource model?

Tony Daly over 11 years ago

Put this at the top of your model which inherits from ActiveResource

          ruby
        
@headers  = { 'Authorization' => "Token token=\"#{ENV['API_KEY']}\"" }

Jamie Hill over 11 years ago

In Rails 4 beta1, I'm getting a "HTTP/1.1 422 Unprocessable Entity" error when attempting a post request to an API. The controller is raising an ActionController::InvalidAuthenticityToken error.

Do I need to somehow disable request forgery protection for APIs?

Jamie Hill over 11 years ago

Found the answer in the Edge Docs here: http://edgeapi.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html#method-i-protect_against_forgery-3F

...others might benefit if this is included in the show notes.

koombea-railscasts over 11 years ago

Hi, How do I test this using rspec?

This part>

authenticate_or_request_with_http_token do |token, options|
  TOKEN == token
end

Jérémy over 11 years ago

Here is a nice answer if your are doing controller or acceptance tests.

If you're like me and went with Rack::Test::Methods (see this post section 'Testing your API', some examples here as well), here's the solution (which was a pain to figure out ...) :

          ruby
        
get '/api/v1/users.json', nil, 'HTTP_AUTHORIZATION' => ActionController::HttpAuthentication::Token.encode_credentials('THE-AWESOME-TOKEN')

And here is a little helper to keep things DRY :

          ruby
        
def perform(method, url, params = {})
  token = ActionController::HttpAuthentication::Token.encode_credentials(Settings.application_api.token)
  send method, url, params, 'HTTP_AUTHORIZATION' => token

end

Raj over 11 years ago

I have a readonly api hosted on heroku. I also built an android client for this api.

What I want is that only my android app should be able to consume this api.

What is the best possible solution I can apply. Do I need ssl certificate?

Thanks in advance!!

knthornt about 11 years ago

I don't know much about android, but I would assume you can get the device Id somehow. couldn't you use that as your token and then have your client just send the device id along with the request?

Ramkumar V. over 10 years ago

I know this is a little late but I recently released a gem for this exactly this purpose. Do check out Cadinsor.

Yarin Kessler almost 11 years ago

Note that authenticate_or_request_with_http_token will return 401 messages as text/html- not what you want for a JSON API.

I handled this by overriding request_http_token_authentication in the controller:

          ruby
        
def request_http_token_authentication(realm = "Application")  
  self.headers["WWW-Authenticate"] = %(Token realm="#{realm.gsub(/"/, "")}")
  self.__send__ :render, :json => { :error => "HTTP Token: Access denied. You did not provide an valid API key." }.to_json, :status => :unauthorized
end