Authentication

mkdir chapter_09 && touch chapter_09/webapi_basic_auth.rb

# webapi_basic_auth.rb
require 'sinatra'

use Rack::Auth::Basic, 'User Area' do |username, password|
  username == 'john' && password == 'pass'
end

get '/' do
  'Master Ruby Web APIs - Chapter 9'
end

ruby webapi_http_auth.rb

curl -i http://localhost:4567

HTTP/1.1 401 Unauthorized
Content-Type: text/plain
Content-Length: 0
WWW-Authenticate: Basic realm="User Area"
X-Content-Type-Options: nosniff
Connection: keep-alive
Server: thin

curl -v -u john:pass http://localhost:4567

* Rebuilt URL to: http://localhost:4567/
*   Trying ::1...
* connect to ::1 port 4567 failed: Connection refused
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 4567 (#0)
* Server auth using Basic with user 'john'
> GET / HTTP/1.1
> Host: localhost:4567
> Authorization: Basic am9objpwYXNz
> User-Agent: curl/7.43.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Content-Type: text/html;charset=utf-8
< Content-Length: 32
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< Connection: keep-alive
< Server: thin
<
* Connection #0 to host localhost left intact
Master Ruby Web APIs - Chapter 9

Authorization: Basic am9objpwYXNz

touch webapi_digest_auth.rb && touch config.ru

# webapi_digest_auth.rb
require 'sinatra'

get '/' do
  'Master Ruby Web APIs - Chapter 9'
end

# config.ru
require File.expand_path '../webapi_digest_auth.rb', __FILE__

app = Rack::Auth::Digest::MD5.new(Sinatra::Application) do |username|
  # Here we need to return the password for a specific username
  {'john' => 'pass'}[username]
end

app.realm = 'User Area'
app.opaque = 'secretkey'

run app

rackup config.ru

gem install rack

curl -i http://localhost:9292

HTTP/1.1 401 Unauthorized
Content-Type: text/plain
Content-Length: 0
WWW-Authenticate: Digest realm="User Area",
  nonce="MTQ2NDUxNDkzNyA4MmNiMTc4ZjVjZGM1MTNlMDg4YjNlNzRlMDQyODZiMA==",
  opaque="f2f555205f367f5b51faee7ebb8dcc1b",
  qop="auth"
Connection: keep-alive
Server: thin

curl -v --digest -u john:pass http://localhost:9292

* Rebuilt URL to: http://localhost:9292/
*   Trying ::1...
* connect to ::1 port 9292 failed: Connection refused
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 9292 (#0)
* Server auth using Digest with user 'john'
> GET / HTTP/1.1
> Host: localhost:9292
> User-Agent: curl/7.43.0
> Accept: */*
>

< HTTP/1.1 401 Unauthorized
< Content-Type: text/plain
< Content-Length: 0
< WWW-Authenticate: Digest realm="User Area",
   nonce="MTQ2NDUxNDk0OSBjMzNiODQ5NGQwODEzYTBjMzBjYmYwMzQzMDkyZGZjNQ==",
   opaque="f2f555205f367f5b51faee7ebb8dcc1b",
   qop="auth"
< Connection: keep-alive
< Server: thin
<

* Connection #0 to host localhost left intact
* Issue another request to this URL: 'http://localhost:9292/'
* Found bundle for host localhost: 0x7fc98bc0f090
* Re-using existing connection! (#0) with host localhost
* Connected to localhost (127.0.0.1) port 9292 (#0)
* Server auth using Digest with user 'john'

> GET / HTTP/1.1
> Host: localhost:9292
> Authorization: Digest username="john", realm="User Area",
  nonce="MTQ2NDUxNDk0OSBjMzNiODQ5NGQwODEzYTBjMzBjYmYwMzQzMDkyZGZjNQ==",
  uri="/",
  cnonce="M2M1ZTVmYjdiZDFjOTM1MmQ0YWZlYzBhNmJlMDMyODg=", nc=00000001,
  qop=auth,
  response="117ce0f57aa4b552e5ce364902826b56",
  opaque="f2f555205f367f5b51faee7ebb8dcc1b"
> User-Agent: curl/7.43.0
> Accept: */*
>

< HTTP/1.1 200 OK
< Content-Type: text/html;charset=utf-8
< Content-Length: 32
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< Connection: keep-alive
< Server: thin
<
* Connection #0 to host localhost left intact
Master Ruby Web APIs - Chapter 9

touch webapi_token_auth.rb

# webapi_token_auth.rb
require 'sinatra'
require 'json'

# This is our database of users
users = { 'thibault@samurails.com' => 'supersecret' }

# We will store tokens in this hash
tokens = {}

helpers do
  def unauthorized!
    response.headers['WWW-Authenticate'] = 'Token realm="Token Realm"'
    halt 401
  end

  def authenticate!(tokens)
    auth = env['HTTP_AUTHORIZATION']
    # We check if the Authorization header was provided
    # and if it matches the format we want: Token lfkdsfkdsjfsf
    unauthorized! unless auth && auth.match(/Token .+/)
    _, access_token = auth.split(' ')
    # Then we check in the tokens hash if there
    # is a token with the value sent by the client
    unauthorized! unless tokens[access_token]
  end
end

get '/' do
  authenticate!(tokens)
  'Master Ruby Web APIs - Chapter 9'
end

post '/login' do
  params = JSON.parse(request.body.read)
  email = params['email']
  password = params['password']

  content_type 'application/json'
  # If the email and password are correct
  if users[email] && users[email] == params['password']
    # We generate a token
    token = SecureRandom.hex
    # Store it in the tokens hash with a way
    # to get the user from that token
    tokens[token] = email
    { 'access_token' => token }.to_json
  else
    # If not, we send back a generic error message
    # To prevent attackers from knowing when they got
    # an email or password correctly.
    halt 400, { error: 'Invalid username or password.' }.to_json
  end
end

delete '/logout' do
  authenticate!(tokens)
  tokens.delete(access_token)
  halt 204
end

curl -i http://localhost:4567

HTTP/1.1 401 Unauthorized
Content-Type: text/html;charset=utf-8
WWW-Authenticate: Token realm="Token Realm"
Content-Length: 0
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Server: thin

curl http://localhost:4567/login \
  -i -d '{"email":"thibault@samurails.com", "password": "supersecret"}'

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 51
X-Content-Type-Options: nosniff
Connection: keep-alive
Server: thin

{"access_token":"6afc7f5db9eaaf7eab423e35458b12be"}

curl -i -H 'Authorization: Token 6afc7f5db9eaaf7eab423e35458b12be' \
  http://localhost:4567

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Content-Length: 32
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Server: thin

Master Ruby Web APIs - Chapter 9

curl -i -X DELETE -H 'Authorization: Token 6afc7f5db9eaaf7eab423e35458b12be' \
  http://localhost:4567/logout

HTTP/1.1 204 No Content
X-Content-Type-Options: nosniff
Connection: close
Server: thin

touch webapi_apikey_auth.rb

# webapi_apikey_auth.rb
require 'sinatra'
require 'json'

API_KEY = 'ZmvhBBpb4RlbyblpKoj9F716CoONTOtr'

before do
  auth = env['HTTP_AUTHORIZATION']
  unless auth && auth.match(/Key #{API_KEY}/)
    response.headers['WWW-Authenticate'] = 'Key realm="User Realm"'
    halt 401
  end
end

get '/' do
  'Master Ruby Web APIs - Chapter 9'
end

ruby webapi_apikey_auth.rb

curl -i http://localhost:4567

HTTP/1.1 401 Unauthorized
Content-Type: text/html;charset=utf-8
WWW-Authenticate: Key realm="User Realm"
Content-Length: 0
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Server: thin

curl -i -H "Authorization: Key ZmvhBBpb4RlbyblpKoj9F716CoONTOtr" \
  http://localhost:4567

HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Content-Length: 32
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Server: thin

Master Ruby Web APIs - Chapter 9%