Token-based authentication in Ruby on Rails - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is token-based authentication in Rails?

Token-based authentication is a way to verify a user's identity by issuing a unique token after login. This token is sent with each request to prove the user is authorized, without needing to send username and password every time.

beginner

How does Rails typically store tokens for API authentication?

Rails often stores tokens in the database linked to the user, usually in a column like authentication_token. This token is sent in request headers to authenticate API calls.

intermediate

Why is token-based authentication better than session-based for APIs?

Token-based authentication is stateless, meaning the server does not keep session info. This makes it easier to scale APIs and allows clients like mobile apps to authenticate without cookies.

beginner

What HTTP header is commonly used to send the token in Rails API requests?

The Authorization header is commonly used, often with the format Bearer <token> to send the token securely with each request.

beginner

How can you generate a secure token in Rails?

You can use SecureRandom.hex(20) or has_secure_token in Rails models to generate a random, secure token string for authentication.

Which of these is a key benefit of token-based authentication in Rails APIs?

A It only works with web browsers

B It requires cookies to work

C It is stateless and scales well

D It stores passwords in tokens

Token-based authentication is stateless, meaning the server does not store session info, making it easier to scale APIs.

Where is the authentication token usually sent in an API request?

A In the Authorization HTTP header

B In the URL query string

C In the request body only

D In a cookie named 'token'

Tokens are commonly sent in the Authorization header, often as 'Bearer '.

Which Rails method helps generate a secure random token?

A SecureRandom.hex

B rand()

C to_s

D digest()

SecureRandom.hex generates a secure random hexadecimal string suitable for tokens.

What does 'stateless' mean in token-based authentication?

A Client must send username and password every time

B Server stores user sessions in memory

C Tokens expire immediately

D Server does not keep session info

Stateless means the server does not keep session info; the token itself carries the authentication data.

Which of these is NOT a good practice for token-based authentication?

A Storing tokens securely in the database

B Sending tokens in plain HTTP

C Sending tokens over HTTPS

D Using long random tokens

Tokens should never be sent over plain HTTP because it risks interception.

Explain how token-based authentication works in a Rails API.

Think about the steps from login to making authenticated API calls.

Describe why token-based authentication is preferred over session-based authentication for APIs.

Consider how servers handle user state and how clients communicate.