Question

I’m fairly new to Rails and I’m trying to implement a really basic user authentication system. My main problem right now is that I do not have a clue what’s a good design for this.

What I have now

My Rails app is not a website; it’s a webservice that communicates with an iPhone app. All communication is in JSON.

When a user signs up, the app sends a POST request to /users.json with name and password as JSON in the HTTP body. Rails then saves the user id in a cookie:

cookies.signed[:user_id] = @user.id

When a user logs out, the app sends a POST request to /logout.json. Rails gets the user id from the cookie, updates the database and deletes the cookie.

Later, when the user wants to log in again, the app sends a POST request to /login.json with name and password as JSON in the HTTP body. Rails sets the cookie again.

My question(s)

1. Is this design RESTful? Because login and logout aren’t resources.
2. Is it secure to use cookies like this? I’m planning to use SSL.
3. Is there a better way to do this?

Answer 1

Tt’s a very basic approach

A more RESTful way:

Create a controller called sessions with a create and destroy action. Throw the login/logout out of your head and start thinking in sessions. A login is just a username/password combination. When you login you create/start a session, when you log out you destroy the session. The login is not affected.

Instead of using cookies.signed[:user_id] you should use session[:user_id]

SSL is a big plus, because the password can’t be sniffed through the network.

And there are lots of out-of-the-box authentication systems.

My favourite is Devise:

https://github.com/plataformatec/devise

http://asciicasts.com/episodes/209-introducing-devise

http://railscasts.com/episodes/209-introducing-devise