ruby - API Authentication and use of OAuth2 -

ruby - API Authentication and use of OAuth2 -

i’m trying head around how introduce token-based (key-based?) authentication web api (currently looking @ sinatra, maybe rails too) used mobile client , how oauth fit picture.

so, let’s want create web service uses facebook authentication , grabbing basic user data. here, api client facebook’s oauth server, requesting access token upon user’s successful login facebook. grant me access user’s info utilize create entry in database, storing user-specific token other application info linked them.

i think got part right far, here’s i’m bit confused.

i think api need form of api key grant access mobile user, since wouldn’t want transmit , store facebook key on device. have have separate store of keys provide client access service? there ‘best practice’ ways of doing this?

would have have separate store of keys provide client access service?

yes.

are there ‘best practice’ ways of doing this?

the simplest way generate separate authentication token on every user creation , expose mobile client. send every subsequent request header.

devise provides simple example how accomplish that. don't need devise that, provide token generation mechanism.

#devise.friendly_token def self.friendly_token securerandom.urlsafe_base64(15).tr('lio0', 'sxyz') end

this mechanism can extended provide more security in next ways

being oauth2 provider itself. on successfull login facebook, generate :authorization_code client can exchange own oauth2 bearer or mac token within next step. can send own oauth2 token every request user authentication. see rack-oauth2

implement hmac token encryption. generate , expose secret_key every client after singning in. utilize secret sign messages along unique client id. server can lookup secret_key specific client_id , verify message. see api-auth

ruby api authentication oauth sinatra