{"action":"created","issue":{"url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/183","repository_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth","labels_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/183/labels{/name}","comments_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/183/comments","events_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/183/events","html_url":"https://github.com/lynndylanhurley/devise_token_auth/issues/183","id":60978639,"number":183,"title":"Token based authentication with no sessions","user":{"login":"c0mrade","id":27664,"avatar_url":"https://avatars.githubusercontent.com/u/27664?v=3","gravatar_id":"","url":"https://api.github.com/users/c0mrade","html_url":"https://github.com/c0mrade","followers_url":"https://api.github.com/users/c0mrade/followers","following_url":"https://api.github.com/users/c0mrade/following{/other_user}","gists_url":"https://api.github.com/users/c0mrade/gists{/gist_id}","starred_url":"https://api.github.com/users/c0mrade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/c0mrade/subscriptions","organizations_url":"https://api.github.com/users/c0mrade/orgs","repos_url":"https://api.github.com/users/c0mrade/repos","events_url":"https://api.github.com/users/c0mrade/events{/privacy}","received_events_url":"https://api.github.com/users/c0mrade/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2015-03-13T04:10:52Z","updated_at":"2016-08-16T02:58:53Z","closed_at":"2015-03-13T19:53:09Z","body":"Hello everybody,\r\n\r\nI'm trying to accomplish the following :\r\n- Build a standalone API, which will be consumed by web client for now which runs on a separate server instance, and later possibly by Android/IOS.\r\n- Build a standalone angular app using [ng-token-auth](https://github.com/lynndylanhurley/ng-token-auth) which will consume the above API.\r\n\r\nMy only config is :\r\n```\r\nconfig.change_headers_on_each_request = false\r\n```\r\n\r\nSo I've got a form setup on my client angular app, which when the login form is submitted using path `/api/v1/auth/sign_in` and that path is defined in my api like this :\r\n\r\n```\r\nuser_session POST   /api/v1/auth/sign_in(.:format)            devise_token_auth/sessions#create\r\n```\r\n\r\nAnd khabum! The error in the log :\r\n\r\n```\r\nOmniAuth::NoSessionError (You must provide a session to use OmniAuth.):\r\n```\r\n\r\nThen I think to myself what session, this is an API not a web app! and then I take a look at my middleware which looks like this, yeah no sessions, cookies etc:\r\n\r\n```\r\nuse ActionDispatch::Static\r\nuse Rack::Lock\r\nuse #<ActiveSupport::Cache::Strategy::LocalCache::Middleware:0x213ef7c4>\r\nuse Rack::Runtime\r\nuse ActionDispatch::RequestId\r\nuse Rails::Rack::Logger\r\nuse ActionDispatch::ShowExceptions\r\nuse ActionDispatch::DebugExceptions\r\nuse Rollbar::Middleware::Rails::RollbarMiddleware\r\nuse ActionDispatch::RemoteIp\r\nuse ActionDispatch::Reloader\r\nuse ActionDispatch::Callbacks\r\nuse ActiveRecord::Migration::CheckPending\r\nuse ActiveRecord::ConnectionAdapters::ConnectionManagement\r\nuse ActiveRecord::QueryCache\r\nuse ActionDispatch::ParamsParser\r\nuse Rack::Head\r\nuse Rack::ConditionalGet\r\nuse Rack::ETag\r\nuse Warden::Manager\r\nuse Rack::Cors\r\nuse Bullet::Rack\r\nuse OmniAuth::Builder\r\nrun MyApi::Application.routes\r\n```\r\n\r\nI'm using the `rails-api` gem which provides more lightweight version of rails with no session etc.\r\n\r\nThis is how my application controller looks like (Ignoring the namespace) :\r\n\r\n```\r\nclass ApplicationController < ActionController::API\r\n      include ActionController::MimeResponds\r\n      include DeviseTokenAuth::Concerns::SetUserByToken\r\n\r\n      def root\r\n        render :text => 'Welcome to API friend, you came to the right place!'\r\n      end\r\n    end\r\n```\r\n\r\nSo since the create action is processed by this gems session controller `devise_token_auth/sessions#create`, I tried to create my own controller override to see what's going on with this. And I did this :\r\n\r\n```\r\nmount_devise_token_auth_for 'User', at: '/api/v1/auth', controllers: {\r\n    sessions:      'api/v1/login'\r\n  }\r\n```\r\n\r\nSo now I had my new controller, very simple :\r\n\r\n```\r\n class LoginController < ApplicationController\r\n      before_filter :set_user_by_token, :only => [:destroy]\r\n\r\n      def create\r\n        Rails.logger.info('TEEEST')\r\n        # Check\r\n        binding.pry\r\n     end\r\nend\r\n```\r\n\r\nHowever again same error with the sessions and omniauth, code never reaches my sessions controller, caused by my initializer :\r\n\r\n```\r\nOmniAuth.config.logger = Rails.logger\r\n\r\nRails.application.config.middleware.use OmniAuth::Builder do\r\n  provider :facebook,      ENV['FACEBOOK_KEY'], ENV['FACEBOOK_SECRET'], :scope => 'email,user_birthday'\r\n  provider :google_oauth2, ENV[\"GOOGLE_CLIENT_ID\"], ENV[\"GOOGLE_CLIENT_SECRET\"]\r\nend \r\n```\r\n\r\nSo I try to remove the initializer and observed that now the code actually reaches my controller and that I can authenticate if I add some code to it.\r\n\r\nSo there is no way (at the moment), for non session based authentication to work in combination with google/facebook.\r\n\r\nBut I'm thinking I should be able to do (two different type of users):\r\n1. Provide username and password in the angular website, then send those with form to the API, and API responds with token. Which I would use then for some time.\r\n2. Click on  the login with Facebook button, obtain token from facebook and do stuff with that token, which you would do with the token obtained by providing username/password in case 1.\r\n\r\nBut there is workaround for this (to support both types of auth), and it is (add session middleware to make omniauth happy), this is my application.rb :\r\n\r\n```\r\nconfig.middleware.insert_after(ActiveRecord::QueryCache, ActionDispatch::Cookies)\r\nconfig.middleware.insert_after(ActionDispatch::Cookies, ActionDispatch::Session::CookieStore)\r\n```\r\n\r\nAm I missing something here? Why do I need the session at all, any suggestion how to go around this? Should I even go a round I mean ..  \r\n\r\nThis might be what @nicolas-besnard was talking about in seperate threads or not.."},"comment":{"url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/comments/239988799","html_url":"https://github.com/lynndylanhurley/devise_token_auth/issues/183#issuecomment-239988799","issue_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/183","id":239988799,"user":{"login":"betoharres","id":1681530,"avatar_url":"https://avatars.githubusercontent.com/u/1681530?v=3","gravatar_id":"","url":"https://api.github.com/users/betoharres","html_url":"https://github.com/betoharres","followers_url":"https://api.github.com/users/betoharres/followers","following_url":"https://api.github.com/users/betoharres/following{/other_user}","gists_url":"https://api.github.com/users/betoharres/gists{/gist_id}","starred_url":"https://api.github.com/users/betoharres/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/betoharres/subscriptions","organizations_url":"https://api.github.com/users/betoharres/orgs","repos_url":"https://api.github.com/users/betoharres/repos","events_url":"https://api.github.com/users/betoharres/events{/privacy}","received_events_url":"https://api.github.com/users/betoharres/received_events","type":"User","site_admin":false},"created_at":"2016-08-16T02:58:53Z","updated_at":"2016-08-16T02:58:53Z","body":"It worked for me using rails 5.0.0.1\r\n\r\n``in config/application.rb``\r\n```\r\n    # Only loads a smaller set of middleware suitable for API only apps.\r\n    # Middleware like session, flash, cookies can be added back manually.\r\n    # Skip views, helpers and assets when generating a new resource.\r\n    config.api_only = true\r\n    config.middleware.use ActionDispatch::Flash\r\n    config.middleware.use ActionDispatch::Cookies\r\n    config.middleware.use ActionDispatch::Session::CookieStore\r\n```"}}
{"actor":{"display_login":"betoharres"}}