Add API Token auth #884
Merged
Add API Token auth #884
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
connorshea
added
enhancement
If the user sends an Authorization header, the OAuth checks are run. Otherwise, authenticate with a token. If the token is invalid, the simple token authentication gem will raise and halt the request. This should be Perfectly Secure™.
Add an endpoint for resetting the user's authentication token. Add an endpoint for displaying the API token to the user.
Still not sure why the GraphQL request spec is failing.
authentication token.
connorshea
force-pushed
the
simple-token-auth
branch
from
38036c3 to
1e81b37
Compare
connorshea
force-pushed
the
simple-token-auth
branch
from
2646e94 to
8c06e68
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #883.
This adds support for authenticating using API Tokens. This will simplify the process of interacting with the API since you'll no longer need to use an OAuth application.
This implementation isn't perfect. For one, the tokens are stored unencrypted in the database, which I don't like. And the
simple_token_authenticationgem creates tokens even if the user doesn't need one, which is also annoying. I might replace this with a self-made implementation in the future since the gem is pretty simple already, but I don't think these problems are quite bad enough to warrant not shipping this as-is.