title: HTTP requests, session keys, and authorization as they relate to Rails
body: <p>I've been working on the development of an Android app in my spare time for several months now. I've done all of my planning for the on-device side (except for server-side interaction), but I've been met with a very steep learning curve for the on-server side implementation. I've researched for about a month with no real leads. Consequently, I'm really at a dead end. The app that I'm working on included these minimal requirements:</p>
  
  <ul>
  <li><p>Must offer account creation/authentication to the server from the<br>
  device</p></li>
  <li><p>Must maintain some sort of session that allows the user authorization
  to make changes that will impact only the on-server user data within the context of the account that they are logged in to.</p></li>
  <li><p>The ability to log out/be logged out by the server under certain conditions.</p></li>
  </ul>
  
  <p>A web interface will not be necessary, as this service is only to be consumed by Android devices. </p>
  
  <p>I've decided that a Rails implementation is the most desirable option for me. My experience with Rails and servers in general is very limited. A friend recommended that I read though "Agile Web Development with Rails" in order to get up to speed. I made it through enough of the Depot Application demo in order to understand ORM libraries, the MVC pattern, and scaffolding, but then I got fed up with the way that the book presents the information. Everything is very sequential, and the authors seem to omit a lot of the "how", saying that they'll explain later, and to just not worry about it until that point. That's not the way I learn. I digress.</p>
  
  <p>So far I've used scaffolding in Rails to generate a model, view, and a controller for an Accounts table. I've set up attributes for a username, password, session_key (a randomly generated key that the user should receive and use to connect from their device after login), etc using scaffolding. I am validating the username and session_key to ensure that they're unique, and my alphanumeric key generation is working properly (all of which is done in the model). </p>
  
  <p>Now I'd like to focus on managing sessions in a restful manner. I know that I'll need to implement this by having Android devices pass their user's session key to the server when making HTTP requests and accessing resources etc., but other than that I'm at a loss. </p>
  
  <p>I'm looking for someone to provide me with a good resource (or explanation) outlining how HTTP requests and responses work in general, how JSON information can be received and parsed using a request, and how to otherwise manage restful authorization (assuming that the user has already been assigned their session key). If my approach isn't quite right, please let me know what you would suggest. </p>
  
  <p>Thanks!</p>