{"action":"opened","issue":{"url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/244","repository_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication","labels_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/244/labels{/name}","comments_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/244/comments","events_url":"https://api.github.com/repos/gonzalo-bulnes/simple_token_authentication/issues/244/events","html_url":"https://github.com/gonzalo-bulnes/simple_token_authentication/issues/244","id":149580699,"number":244,"title":"Best strategy for Web Sign In. Cookie authentication method.","user":{"login":"oscarsiniscalchi","id":907991,"avatar_url":"https://avatars.githubusercontent.com/u/907991?v=3","gravatar_id":"","url":"https://api.github.com/users/oscarsiniscalchi","html_url":"https://github.com/oscarsiniscalchi","followers_url":"https://api.github.com/users/oscarsiniscalchi/followers","following_url":"https://api.github.com/users/oscarsiniscalchi/following{/other_user}","gists_url":"https://api.github.com/users/oscarsiniscalchi/gists{/gist_id}","starred_url":"https://api.github.com/users/oscarsiniscalchi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oscarsiniscalchi/subscriptions","organizations_url":"https://api.github.com/users/oscarsiniscalchi/orgs","repos_url":"https://api.github.com/users/oscarsiniscalchi/repos","events_url":"https://api.github.com/users/oscarsiniscalchi/events{/privacy}","received_events_url":"https://api.github.com/users/oscarsiniscalchi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-04-19T20:52:53Z","updated_at":"2016-04-19T20:52:53Z","closed_at":null,"body":"I have used this gem for a few months on an API backend project that serves data to a iOS and an Android frontends.\r\nThe gem is great, I had to do some changes to work around some technical requirements I had: my login goes against an external API I do not control, so I basically get the login request, check the external API, if the login success, I regenerate the Auth token and return that to the mobile clients to include on any request that needs authentication. Just recently we have decided to add a web frontend for the same app, so I decided to build the authentication for this new front end the similar to how it works for mobile clients > I make the login via ajax and on success store the auth token-email pair in a cookie so I can send in future auth requests.\r\nHowever what I am struggling with at the moment is, after the user is signed in let say I do a GET request to `/user/profile` how do I authenticate the user here? do I mandatory need to send the auth pair via get parameters? is there a better way to do this you guys could think of?\r\nWouldn't be good to be able to also support authentication method from cookies? can you think of a disadvantage of supporting the latest?\r\n\r\nI would much appreciate your input and advice on this one since I want to try to build this on the cleanest way possible.\r\n\r\nRegards"}}