JSON Web Tokens with Devise & Warden Discussion

Great tutorial.

Love this series. I've implemented this devise/warden strategy in my own project. One correction: Because the `before_action` in the ApiController is changed from `:authenticate_token!` to `:authenticate_user!`, the `skip_before_action` in the AuthenticationController must also change to `authenticate_user!`, otherwise devise will reply with "You must sign in or sign up before continuing."

Keep the great material coming, Chris.

One more thought: As you pointed out, many websites will want to accept both JWT requests and non-JWT requests via the same API. By adding `skip_before_action :verify_authenticity_token` without disabling non-JWT requests, don't we open a hole to CSRF attack from non-JWT requests?

Here's a possible solution; would love to have your thoughts.

In the API controller:

skip_before_action :verify_authenticity_token, if: :json_web_token_present?

def json_web_token_present?
current_user.has_json_web_token
end

In the User model:

class User < ActiveRecord::Base
attr_accessor :has_json_web_token
end

In the strategy:

def authenticate!
...
user = User.find(payload["sub"])
user.has_json_web_token = true
success! user
...
end

Just thought I'd share these two blog posts I found pretty useful when I looked for more detail on web tokens vs. cookies:

https://auth0.com/blog/angu...
https://auth0.com/blog/ten-...

Hello,

You can create an episode with the same typology using a project of this type:

rails new weather --api

thank you

Regards

Hello

I have a token problem if I use the 'jwt', '~> 2.0' gem of Invalid auth token when inserting a record.

Chris could you help me with this?

Thank you

Antonio.

for authentication_controller, skip_before_action :authenticate_token! should be changed to skip_before_action :authenticate_user! because ApiController has changed.

I keep running into this error:

2.5.1 :004 > JsonWebToken.encode({sub: 1})
Traceback (most recent call last):
 2: from (irb):4
 1: from app/models/json_web_token.rb:4:in `encode'
TypeError (no implicit conversion of nil into String)

Any ideas on how I can debug this?

I'm struggling to figure out where to put sign_in(user, store: false) to prevent the rails server from setting the cookies. It says to put it where we "log in the user" but to my understanding, that was handled by the success! method.

Could someone please provide a little more direction on how to prevent that cookie from being set?

On a similar note, is there a way to not make it update the current_sign_in_at, last_sign_in_at and sign_in_count values?

Thanks! :)

Hey Chris am having issues with verify_authenticity_token When i deploy on heroku. But the same works locally.

Just wondering what you meant by this being for learning purposes in the first minute in your video. Is it generally a bad idea to implement a custom JWT authentication on top of devise in a production app?

I learned in the tutorial from the 53rd second that this authentication method is experimental and not the best. I will love to know the best way to go about it. I have a project I want to use devise_jwt on