I’ve been working on the development of an Android app in my spare time for several months now. I’ve done all of my planning for the on-device side (except for server-side interaction), but I’ve been met with a very steep learning curve for the on-server side implementation. I’ve researched for about a month with no real leads. Consequently, I’m really at a dead end. The app that I’m working on included these minimal requirements:
-
Must offer account creation/authentication to the server from the
device -
Must maintain some sort of session that allows the user authorization
to make changes that will impact only the on-server user data within the context of the account that they are logged in to. -
The ability to log out/be logged out by the server under certain conditions.
A web interface will not be necessary, as this service is only to be consumed by Android devices.
I’ve decided that a Rails implementation is the most desirable option for me. My experience with Rails and servers in general is very limited. A friend recommended that I read though “Agile Web Development with Rails” in order to get up to speed. I made it through enough of the Depot Application demo in order to understand ORM libraries, the MVC pattern, and scaffolding, but then I got fed up with the way that the book presents the information. Everything is very sequential, and the authors seem to omit a lot of the “how”, saying that they’ll explain later, and to just not worry about it until that point. That’s not the way I learn. I digress.
So far I’ve used scaffolding in Rails to generate a model, view, and a controller for an Accounts table. I’ve set up attributes for a username, password, session_key (a randomly generated key that the user should receive and use to connect from their device after login), etc using scaffolding. I am validating the username and session_key to ensure that they’re unique, and my alphanumeric key generation is working properly (all of which is done in the model).
Now I’d like to focus on managing sessions in a restful manner. I know that I’ll need to implement this by having Android devices pass their user’s session key to the server when making HTTP requests and accessing resources etc., but other than that I’m at a loss.
I’m looking for someone to provide me with a good resource (or explanation) outlining how HTTP requests and responses work in general, how JSON information can be received and parsed using a request, and how to otherwise manage restful authorization (assuming that the user has already been assigned their session key). If my approach isn’t quite right, please let me know what you would suggest.
Thanks!
For authentication, you might want to check out: http://railscasts.com/episodes/250-authentication-from-scratch You’ll basically just be performing the authentication using the session_key. There are other more complicated things you might do, and you could check out authlogic, devise, sorcery, etc. to see how they implement keeping sessions alive. Since you need log outs, and presumably the need to log back in, I would suggest looking into using the session key you describe as the master authentication and then have a perishable key of some sort that gets reset after every request and sent back to the client as a keepalive. Depending on your ultimate needs, that might be enough security and functionality.
For JSON receiving, rails has built-in parsing. Look into respond_to. For sending back JSON, you can use any number of methods. The most basic is to just allow rails to automatically convert the JSON (which happens when respond_with is used, as in the link). You could also build out presenter classes or use something a little more formal like rabl.