Omniauth Outside Devise Strategy
I have setup devise + omniauth for google login. It works great online. I am now looking into integrating oauth sign with iOS / Android clients.
I followed https://developers.google.com/identity/sign-in/ios/backend-auth and found that the library I am using for oauth does these things ( https://github.com/zquestz/ omniauth-google-oauth2 / blob / master / lib / omniauth / strategies / google_oauth2.rb ).
I don't understand if I can use the omniauth strategy outside of my normal web workflow (i.e. from rails console
) to build a pseudo request.env["omniauth.auth"]
. Is this possible? In the documentation https://developers.google.com/identity/sign-in/ios/backend-auth#using-a-google-api-client-library I would like to do the equivalent in Ruby (and it is not clear if I can directly use Devise for this).
source to share
Simulating console requests is pretty straightforward. You can easily query the variable app
that the console provides:
app.get('/') # => 200
app.response # => #<ActionDispatch::TestResponse:0x007fc73e4db220>
Regarding authentication handling, standard rail apps use cookie / session-based authentication strategies on the internet. After authenticating for the first time, some information is stored in the session (often in the form of a cookie), which you and the server will pass back and forth with each request.
Since mobile clients don't rely on cookies, we need a different authentication strategy: token-based authentication .
Here's a high-level implementation that will work with Omniauth:
- User Requests Access through the Omniauth proxy by making requests to the Omniauth endpoint
- Application processes credentials
- The app provides the signed token to the client
- The client stores this token and sends it along with every request
- The server checks the token and responds with data
For handling mobile requests, you need to be careful to keep track of the fine print for the Omniauth gem supplier .
Token authentication was used for processing in Devise, but it has been removed. Fortunately, there are several gems that add auth tokens to Devise:
source to share