Skip to main content
Ask A Question
You’re not receiving notifications from this thread.

JSON Web Token Authentication From Scratch Discussion

General • Asked by Chris Oliver

So does this mean that the authentication is now also a token based API? Is this testable on postman?

I redid my whole authentication because I found that the Devise gem (the way it came out of the box) wasn't allowing me to make it into a token based API for me to use with my iOS app.

This setup is for only accepting tokens to authenticate on the API. You can just pass over the Authorization header in Postman to test it out. You'll need a valid token, but just pass in "Authorization: bearer YOURTOKEN" as the header and that should do it.

Btw, the other episode I posted today shows how you can take this code and add it as a Devise strategy so you can use tokens to authenticate with Devise alongside cookies. Check that one out so you can see how to use Devise with it. :)

Hey Chris,

Thanks for the great episode. There is a thing though that I don't understand. There can be many tokens for the same user (for instance the user logs in again --> everything is the same except secret signature OR a fake one that has the same payload). According to my understanding, to make sure everything goes fine you should check against the secret signature, but I don't see it in the video. When you create a token and send it back to the user, shouldn't you also save the token or at least the secret signature part of the token? Then when the client sends over the token you can check if the secret signature in the db is the same as in the request.

What you do in the video is only checking the payload part, and I don't really understand how that could work securely.

The JWT gem we use verifies the signature every time you call decode on it, so every token is verified, as well as the expirations and other features it supports. It's fine to have multiple tokens per user (one for each device for example) but because things can change you want to use expirations so they can get a more recent version of the token. There's no need to store anything server-side in the db because this is designed to be stateless.

Does that make more sense?

Thanks Chris! Yeah, I got it after this explanation.

Very nice tutorial @excid3:disqus really made a lot of things clear.

Such a great JWT series!! Thank you so much!
Really saving my life!)

Love the suggestion about rescuing and raising, really appreciate the UX thought in the comment.

i am looking at adding an API to my app i want to keep it simple like many other apps uses and a single API key for the account to access my account data.

All these tutorials seemed geared towards user based authentication.

is one way better or worse than the other?

Login or Create An Account to join the conversation.

Subscribe to the newsletter

Join 29,763+ developers who get early access to new screencasts, articles, guides, updates, and more.

    By clicking this button, you agree to the GoRails Terms of Service and Privacy Policy.

    More of a social being? We're also on Twitter and YouTube.