This is a demo application for the rails_api_auth engine.
Install the demo application with
git clone git@github.com:simplabs/rails_api_auth-demo.git
cd rails_api_auth-demo
rake db:migrate
The "Resource Owner Password Credentials Grant" OAuth 2.0 flow allows users
to acquire a Bearer token from the application in exchange for their
credentials (username
and password
). This is the simplest OAuth 2.0 flow
and the one used by most client applications that authenticate against their
own companion API.
To acquire a Bearer token from the application you first need to create a
Login
model that stores the credentials as well as the Bearer token:
rails console
Login.create!(identification: '<some-email-address>', password: '<some-password>', password_confirmation: '<some-password>')
The Bearer token is assigned as a random string automatically when the Login
model is created.
Start the Rails server:
rails server
You can then use these credentials to acquire a Bearer token from the application:
curl -d "grant_type=password&username=email%40test.com&password=test" "http://localhost:3000/token"
{"access_token":"<some token>"}%
With that Bearer token you can then request the application's authenticated
route that requires the presence of a Bearer token in the request in order to
be accessible:
curl -i -H "Authorization: Bearer <some token>" "http://localhost:3000/authenticated"
HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Type: text/html; charset=utf-8
Etag: W/"a79738749bc447f17b58b2936a48b606"
Cache-Control: max-age=0, private, must-revalidate
X-Request-Id: 8af79fb0-77ee-446b-b09f-761ba43da64d
X-Runtime: 0.010946
Server: WEBrick/1.3.1 (Ruby/2.2.1/2015-02-26)
Date: Wed, 15 Jul 2015 09:00:13 GMT
Content-Length: 20
Connection: Keep-Alive
{"success":true}%
When omitting the Bearer token or send an invalid one the route isn't accessible and will respond with HTTP status 401:
curl -i "http://localhost:3000/authenticated"
HTTP/1.1 401 Unauthorized
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Type: text/html
Cache-Control: no-cache
X-Request-Id: a2094bf9-28e4-45e4-99c0-ece3d170e8e3
X-Runtime: 0.002080
Server: WEBrick/1.3.1 (Ruby/2.2.1/2015-02-26)
Date: Wed, 15 Jul 2015 09:01:42 GMT
Content-Length: 0
Connection: Keep-Alive
The application also allows authentication with a Facebook account. To authenticate with your Facebook account you first need to acquire an authentication code for the "Rails API Auth Demo" Facebook application from Facebook (in a real client application, the user would be redirected there or would see this page in a popup):
https://www.facebook.com/dialog/oauth?client_id=708377659294239&scope=public_profile,email&redirect_uri=http://localhost:3000/
After granting access to the application, you will be redirected to your application with an auth code appended to the URL (in a real client application, the client would intercept that redirect and read the auth code from the URL).
http://localhost:3000/?code=<auth code>
You can now use the auth code to acquire a Bearer token from the Rails application. The Rails application will validate the auth code with Facebook's API:
curl -d "grant_type=facebook_auth_code&auth_code=<auth code>" "http://localhost:3000/token"
{"access_token":"<some token>"}%
That Bearer token can be used then to request the authenticated route in the Rails app like above:
curl -i -H "Authorization: Bearer eb7f3ab26a39eec0cdda82803e6f225d70ecad4cb719d801b826ba84555c2e8698f630bca20639f0ea79b29fe99ab7c7a3d781fc9c0696dc17a7f36bf1faac2ed44d9704161ab29715c7054177e35f49a4fd7bbc8e6b4eeb40e2ab362b82f5f337f7df4739fa1366ac7d1fce38429cbfec45c85831564bdd5647537d9b" "http://localhost:3000/authenticated"
HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Type: text/html; charset=utf-8
Etag: W/"a79738749bc447f17b58b2936a48b606"
Cache-Control: max-age=0, private, must-revalidate
X-Request-Id: 8af79fb0-77ee-446b-b09f-761ba43da64d
X-Runtime: 0.010946
Server: WEBrick/1.3.1 (Ruby/2.2.1/2015-02-26)
Date: Wed, 15 Jul 2015 09:00:13 GMT
Content-Length: 20
Connection: Keep-Alive
{"success":true}%
This application is developed by and © simplabs GmbH and contributors. It is released under the MIT License.