Say I have a Web service, called JokeService, which is a Rack/Rails3 app deployed on Heroku. And lets say I have an application, called ComedyApp. Now, I want JokeService to only entertain requests from ComedyApp. To do so, I would like ComedyApp to use a client certificate, which it uses to authenticate itself with JokeService.
My question is, how the heck can I configure the JokeService (again, a Rack/Rails3 app on Heroku) to check the validity of the client certificate?
This is related, but unanswered: How to access SSL client certificate from rack app
In short, you can’t, since we don’t have control of the http layer (thin or the routing mesh) in the stack.
An alternative is to authenticate one’s requests simply using a custom request header.