Rails 3 - 基本的 http 身份验证与 iPhone 的身份验证令牌
最初，我使用基本的 http 身份验证来按照本指南对用户进行身份验证：
http://jessehowarth.com/2011/04/27/ajax-login-with-devise
我成功地验证了用户身份，但会话仍保持登录状态 永远。没有办法破坏用户的会话。事实上，当我添加 user_signed_in?我的 create 方法中的 devise 方法，即使通过 json 注销，它也总是返回 true。所以我得出的结论是，没有办法使用基本的 http 身份验证来结束会话。您真正能做的就是检查用户是否已登录并将状态代码以 json 形式发送回客户端。
然后我尝试了身份验证令牌路由，它允许您使用身份验证令牌创建一个会话，然后通过删除该身份验证令牌来销毁会话，并且用户必须再次登录才能访问需要身份验证的页面，如下所示如这篇文章所示：
这样做的缺点是事实那你有一个非常长的字符串，您必须为每个需要身份验证的页面输入该字符串，这似乎有点不可取。我希望这里能两全其美，您可以像在网络浏览器中一样登录和退出。
我不确定我所说的一切是否准确，但它似乎与这篇文章相符：
在那篇文章中，他表示身份验证令牌“比 http 基本身份验证更安全，因为密钥可能会过期”。我认为他的意思是，一旦您使用基本身份验证登录，就这样，您将永远登录，而身份验证令牌您可以使其过期并强制用户再次登录。这是准确的解释吗？
感谢您的回复
Initially I was using basic http authentication to authenticate a user with devise following this guide:
http://jessehowarth.com/2011/04/27/ajax-login-with-devise
I was successfully able to authenticate a user, but the session remained logged in forever. There was no way to destroy the user's session. In fact, when I added the user_signed_in? method of devise within my create method, it would always return true even when logging out via json. So I came to conclusion that there is no way to end a session using basic http authentication. All you could really do is check if the user is already signed in and send a status code as json back to the client.
So then I tried the authentication token route, which allowed you to create a session with an authentication token and then destroy a session by deleting that authentication token, and the user would have to sign in again in order to access pages that require authentication, as shown in this post:
Devise and Authentication with CURL !
The downside of this is the fact that you have this very long string that you have to enter in for each page that requires authentication, which seems a little undesirable. I wish there was a best of both worlds here, where you can log in and out like you do in a web browser.
Im not sure if everything I am saying is accurate, but it seems in line with this post:
http authentication in devise and rails 3
In that post, he says authentication token is "more secure than http basic authentication since the key can expire". I assume he means that once you are logged in using basic authentication, then that's it, you are logged in forever, whereas authentication token you can expire it and force the user to sign in again. Is this accurate interpretation?
Thanks for response
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
HTTP 身份验证的工作方式是，一旦浏览器登录（即发送 WWW-Authenticate 标头），它将保持登录状态，直到其 HTTP 身份验证缓存过期（通常在您退出浏览器时） 。
由于浏览器继续在 HTTP 身份验证中发送有效凭据（没有“HTTP 注销”），这就是您看到用户仍然登录的原因。
我的建议是使用 Devise 中的
authentication_token功能将?auth_token传递给您的 API。请记住，即使是 POST/DELETE/PUT/etc，您也必须将它们作为 URL 的一部分传递。 （这是一个 Devise 错误，现在可能已修复）。The way that HTTP authentication works, once a browser is logged in (i.e. is sending
WWW-Authenticateheaders), it will stay logged in until its HTTP authentication cache is expired (usually when you exit the browser).Since browsers continue to send valid credentials in HTTP authentication (there is no "HTTP logout"), that's why you're seeing the user still logged in.
My recommendation is to use the
authentication_tokenfunctionality in Devise and pass?auth_tokento your APIs. Keep in mind that you have to pass them as part of the URL even if it is a POST/DELETE/PUT/etc. (this is a Devise bug that may be fixed by now).