Token-based authentication in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What does this Rails controller action return when a valid token is provided?

Consider this Rails API controller action that uses token-based authentication. What will be the JSON response if the token is valid?

Ruby on Rails

class Api::V1::ProfilesController < ApplicationController
  before_action :authenticate_user!

  def show
    render json: { email: current_user.email, name: current_user.name }
  end

  private

  def authenticate_user!
    token = request.headers['Authorization']&.split(' ')&.last
    user = User.find_by(authentication_token: token)
    if user
      @current_user = user
    else
      render json: { error: 'Unauthorized' }, status: :unauthorized
    end
  end

  def current_user
    @current_user
  end
end

A 500 Internal Server Error

B {"email": null, "name": null}

C {"email": "[e-mail]", "name": "Alice"}

D {"error": "Unauthorized"}

💡 Hint

Think about what happens when the token matches a user in the database.

If the token matches a user, the authenticate_user! method sets @current_user. Then the show action returns the user's email and name as JSON.

📝 Syntax

intermediate

Which option correctly defines a method to generate a secure token in a Rails model?

You want to add a method in your Rails User model that generates a unique authentication token. Which code snippet is syntactically correct and secure?

Ruby on Rails

class User < ApplicationRecord
  before_create :generate_authentication_token

  private

  def generate_authentication_token
    # Which option is correct here?
  end
end

A self.authentication_token = SecureRandom.hex(20)

B authentication_token = SecureRandom.hex(20)

C self.authentication_token = SecureRandom.random_number(20)

D authentication_token = SecureRandom.base64(20)

💡 Hint

Remember to assign to the attribute with self. inside instance methods.

Inside instance methods, to set an attribute you must use self.attribute = value. SecureRandom.hex(20) generates a secure 40-character hex string. Other options either miss self. or use incorrect methods.

❓ state_output

advanced

What is the value of current_user after this request with an invalid token?

Given this controller snippet, what will current_user be if the token is invalid?

Ruby on Rails

class Api::V1::SessionsController < ApplicationController
  before_action :authenticate_user!

  def index
    render json: { user: current_user&.email }
  end

  private

  def authenticate_user!
    token = request.headers['Authorization']&.split(' ')&.last
    user = User.find_by(authentication_token: token)
    if user
      @current_user = user
    else
      render json: { error: 'Unauthorized' }, status: :unauthorized
    end
  end

  def current_user
    @current_user
  end
end

A User object with email "[e-mail]"

B nil

C Raises NoMethodError

D "" (empty string)

💡 Hint

What happens if the token does not match any user?

If the token is invalid, @current_user is never set, so current_user returns nil.

🔧 Debug

advanced

Why does this token authentication code always return 'Unauthorized' even with a valid token?

Examine this code snippet. It should authenticate users by token but always returns 'Unauthorized'. What is the bug?

Ruby on Rails

def authenticate_user!
  token = request.headers['Authorization']&.split(' ')&.last
  user = User.find_by(authentication_token: token)
  if user.nil?
    render json: { error: 'Unauthorized' }, status: :unauthorized
  else
    @current_user = user
  end
end

A The token is not stripped of whitespace before lookup, causing find_by to fail

B The method returns before setting @current_user because render does not halt execution

C The condition should check if user is present, not nil

D The token variable is nil because the header key is case-sensitive and should be 'authorization'

💡 Hint

Check how the token string is extracted and used.

If the token string includes extra spaces or newline characters, find_by will not find the user. Stripping whitespace from the token fixes this.

🧠 Conceptual

expert

Which statement best explains the security benefit of token-based authentication over session-based authentication in Rails APIs?

Choose the most accurate explanation of why token-based authentication is preferred for APIs compared to traditional session-based authentication.

A Sessions require HTTPS, but tokens can be safely sent over HTTP without encryption.

B Tokens automatically expire after 5 minutes, making them more secure than sessions which never expire.

C Token-based authentication requires cookies, which are more secure than headers used in session authentication.

D Tokens are stored on the client and sent with each request, avoiding server-side session storage and enabling stateless APIs.

💡 Hint

Think about how APIs handle user state and scalability.

Token-based authentication stores tokens on the client and sends them with each request, so the server does not need to keep session state. This makes APIs stateless and easier to scale. Other options are incorrect or insecure.