lynndylanhurley / lynndylanhurley/devise_token_auth
Routes method to authenticate does not work
- Dominant language
- Ruby
- Stars
- 3.6k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
Dear author, I do not insist on support here, since I have managed to workaround, but I am
persuaded right now, that I am looking at a bug here. Maybe it will be useful for you.
Here is the way to authenticate a user when accessing a resource:
https://github.com/qutorial/rb-bug-devise-token-auth/blob/authbug/config/routes.rb#L3
This is a clean and declarative way, which is the best, imho, way to do it in rails.
And it does not work with devise token auth. Unauthenticated 401 is the result.
However, once changed to controller-based authentication, everything is Ok.
https://github.com/qutorial/rb-bug-devise-token-auth/blob/master/app/controllers/recipes_controller.rb#L3
(notice a different git branch, please). The change is to remove the authenticate :user from the routes and add before statement to the controller.
Here is the angular token auth client for this backend:
https://github.com/qutorial/rb2-frontend
Since I am providing the whole code, I do not think it is necessary to post the versions (they are in the lock file). Still, I am ready to help, if I can.
The headers are sent just fine by the client. There for the controller-method works.
In the rails stack trace there is nothing useful at all.
Please, check the routes file this is the only difference from the bare bone rails app. Nothing very custom otherwise. The user in the frontend after you do rails db:seed is user@example.com and monkey67 is the password. (To install and run: bundle install, rails db:migrate, rails db:seed, rails server).
Please, refere back to me any time if I could provide more debug infos.
Contributor guide
Research direction
Start with the linked config/routes.rb and compare its authenticate :user route with the before-based authentication in app/controllers/recipes_controller.rb. Reproduce the setup with bundle install, rails db:migrate, rails db:seed, and rails server, then test the Angular client request. Done means route-based authentication accepts the supplied headers instead of returning 401.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- angular, rails, ruby
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100