app/controllers/application_controller.rb
# protect against CSRF, all form CSRF tokens will be managed automatically
protect against CSRF, all form CSRF tokens will be managed automatically
protect against CSRF all form CSRF tokens will be managed automatically
def authenticate_user
    @authenticated = false
    if request.headers['Authorization'].present?
      token = request.headers['Authorization'].scan(/Bearer (.*)$/).flatten.last
      begin
        jwt_payload = JWT.decode(token, 'JWT_SUPER_SECRET', 'HS512').first
        @current_user_id = jwt_payload['id']
        @authenticated = true
        @current_user = User.find(jwt_payload['id'])
      rescue JWT::ExpiredSignature, JWT::VerificationError, JWT::DecodeError
        render json: {success: false, errors: {full_messages: ['Not authenticated, token must be provided and not expired']}}
      end
    end
  end
def authenticate_user @authenticated = false if request . headers [ 'Authorization' ] . present? token = request . headers [ 'Authorization' ] . scan ( / Bearer (.*)$ / ) . flatten . last begin jwt_payload = JWT . decode ( token , 'JWT_SUPER_SECRET' , 'HS512' ) . first @current_user_id = jwt_payload [ 'id' ] @authenticated = true @current_user = User . find ( jwt_payload [ 'id' ] ) rescue JWT :: ExpiredSignature , JWT :: VerificationError , JWT :: DecodeError render json : { success : false , errors : { full_messages : [ 'Not authenticated, token must be provided and not expired' ] } } end end end
protect against CSRF, all form CSRF tokens will be managed automatically
protect against CSRF all form CSRF tokens will be managed automatically
# Return unauthorized if invalid JWT, login if valid, continue as guest otherwise # The third argument is the algorithm, by default it uses HS256, override # head :unauthorized