Question

We have a Rails 3 app using session-based authentication (modified acts_as_authenticated), and a Flex app that needs to be embedded in an html.erb template. The Flex app needs to access routes that have a before_filter set to check if the user is logged in. When interacting with the HTML site, this causes the user to be redirected to a login page, then sets a Rails session property (tied to a cookie) to record that the user is logged in when making future requests.

The Flex app needs to access XML that’s generated by Rails (behind the before_filter) and I don’t want to force the user to log in twice — what should I be passing as a flash parameter to the Flex app so that it can present as “already logged in” if that session exists (ie, the user has logged in via the HTML interface)? I haven’t dealt with this kind of problem before so I’m not sure if I’m even asking the right question. Any advice appreciated!

Answer 1

Integrating flash into your authenticated service can be tricky. You can’t rely on normal http sessions or cookies to manage authentication for you. What is generally regarded best practice is to generate a unique token for each logged in user to pass on every request to the server to prove that they are in fact a logged in user. for example:

• They log in through an html form.
• When you serve up a swf that is going to access authenticated content you give it a flashvar of token=49r03f0239fhduffnkdjfgnas or something like that.
• This token is generated server-side and stored somewhere to be checked on requests.
• On every request to the server you pass this token and check it’s validity.
• If it’s good you perform the action and return the data.
• If it’s bad you prompt the user.

notes:

• tokens should be long and unguessable like a session variable.
• each time they log in you need to generate a new token.
• each time they log out you need to destroy the token.