#352 Securing an API
There are many approaches to locking down an API. Here I start off with HTTP Basic authentication then move on to generating a unique token which can be passed through a URL parameter or HTTP header.
- source codeProject Files in Zip (95.7 KB)
- mp4Full Size H.264 Video (20 MB)
- m4vSmaller H.264 Video (9.66 MB)
- webmFull Size VP8 Video (7.81 MB)
- ogvFull Size Theora Video (25.9 MB)
How do you autocomple the "restrict_access". It looked like it cycled through a few options...
Hi Ryan, lately I've seen a lots of development railscasts for rails API's. What are the best practices to test API's and versions? Because you don't want to break anything down if you implement new features, change the json format later on. What i would like to know is how you guys test your json api's input and output and even with versioning. Maybe this would be a good idea for a railscast.
Hi Anket, I have a same problem over here.
I did some research myself. I think i will try to split my controller and response tests with Capibara gem. What I test in my controllers are the controller logic. I still need to get started with testing on my json responses. Ill give you a update...
One thing i have to use :format => "json" to get json responses, it would be great if it went automatically.
One more thing check RABL git how to test your RABL responses.
Here you go mate ;)
In my previous post, forget about Capibara.
I got a sample how you could test some controllers..
In my setup I use; factorygirl and RSpec.
I hope this helps you..
It would be great to make a screencast about rate limiting.
that would be awesome
If every API users has a API_KEY or Token, you can have a column like 'requests_count' and increment it with each request. When you reach lets say 500, you can return a 500 or something and have rake tasks reset the count after 24 hours or so.
Very useful screencast Ryan.
I'm using a
Usermodel to create an
access_tokenfor each user so that my app can do "Remember Me" using a cookie (so they don't need to login again) as per screencast #274.
Would I use this same
access_tokenfield for the user to be able to call my API?
Can you see any issue in doing that?
Or should they be different?
Try rack api throttling with a rack middleware. I forked it to limit throttling to a certain path: https://github.com/christoph-buente/api-throttling
...but would I use the
access_tokenfield to identify the user calling the API?
authenticate_or_request_with_http_token did not work for me, use authenticate_with_http_token (http://apidock.com/rails/v3.2.3/ActionController/HttpAuthentication/Token/ControllerMethods/authenticate_with_http_token)
Great cast, really helped me secure my API. One question, how can I pass a token and userid with a request for authenticate_or_request_with_http_token so I can always match a token to a user?
I initial had some trouble implementing this together with Mongoid. It turned out that the problem was in the
mongoid.ymlconfiguration file. When I changed
Everything worked properly. I guess this is because having a proxy server messes with the meaning of
@Matthew Ford(Im sure you found this by now)
For anyone who followed the rails api gem cast you might have problems adding in the:
To use this you will need to add this line:
Please could you give an example of an activeresource model, which calls a protected RESTapi? With curl all is fine, but how can I deliver the token with a activeresource model?
Put this at the top of your model which inherits from
In Rails 4 beta1, I'm getting a "HTTP/1.1 422 Unprocessable Entity" error when attempting a post request to an API. The controller is raising an ActionController::InvalidAuthenticityToken error.
Do I need to somehow disable request forgery protection for APIs?
Found the answer in the Edge Docs here: http://edgeapi.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html#method-i-protect_against_forgery-3F
...others might benefit if this is included in the show notes.
Hi, How do I test this using rspec?
Here is a nice answer if your are doing controller or acceptance tests.
If you're like me and went with Rack::Test::Methods (see this post section 'Testing your API', some examples here as well), here's the solution (which was a pain to figure out ...) :
And here is a little helper to keep things DRY :
I have a readonly api hosted on heroku. I also built an android client for this api.
What I want is that only my android app should be able to consume this api.
What is the best possible solution I can apply. Do I need ssl certificate?
Thanks in advance!!
I don't know much about android, but I would assume you can get the device Id somehow. couldn't you use that as your token and then have your client just send the device id along with the request?
I know this is a little late but I recently released a gem for this exactly this purpose. Do check out Cadinsor.
authenticate_or_request_with_http_tokenwill return 401 messages as text/html- not what you want for a JSON API.
I handled this by overriding
request_http_token_authenticationin the controller: