Rails: token authentication from scratch

Question

I've got a rails app I want to start enabling some iOS integration with. I have a basic authentication system built mostly from scratch with a little help from Sorcery.

My understanding is there's basically two options for mobile integration: HTTP Basic Auth or Token Auth. From what I've been able to find so far it looks like Token Authentication is the preferred method.

I am not familiar with what token authentication is or how it is supposed to work, and I have not really been able to find any decent guides on this, except for a few tutorials on how to use the relevant module in the Devise library.

So, my question is, what is the basic theory of Token Authentication, and what would a from-scratch token auth system in rails look like? I understand that sharing the code for the entire system might be overkill for an SO answer, but I would be very grateful if anyone can help me understand a basic schematic of how such a system is supposed to work. I'd also happily accept links to any good existing materials on how to do this from scratch, as the main problem is I haven't been able to find anything like that.

Thanks!

Answer 1

Devise and Authlogic have a nice Token Authentication solution. You can either use one of these gems or to implement your own check their source code for inspiration.

Below is my understanding of how token authentication works:

1. The user signs in using a username/password combination through a post request.
2. You authenticate the user and generate a unique token and store it in the db.
3. You send this token back to the iOS device.
4. The device stores this token in memory.
5. Any subsequent call to the api need this token passed in as an additional param to auth the user.
6. For this process to be secure this token needs to have an expiration date and the communication between the iOS device and the server must be encrypted through SSL.
7. For convenience you can store the user credentials on the device using the iOS keychain.

I hope this helps.