blocks|key|2322346|text|免责声明:我不是一个百分之百的，这是可能的方式，你的描述，而不侵入Authlogic的核心功能。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2322347|您将面临的第一个问题是，除非请求是ATOM或RSS来覆盖此请求，否则authlogic将阻止使用SSO令牌进行身份验证，您需要传递一个配置参数(参见此处：http://rdoc.info/github/binarylogic/authlogic/master/Authlogic/Session/Params/Config+)。|offset|length|2322348|核心问题:我不认为有任何“简单”的方法来处理这个功能，但是您可以为类似curl这样的东西传递用户令牌作为参数(使用-G选项)，就像访问url时一样。|style|CODE|2322349|cURL文档：http://curl.haxx.se/docs/manpage.html|2322350|entityMap|0|LINK|mutability|MUTABLE|url|http://rdoc.info/github/binarylogic/authlogic/master/Authlogic/Session/Params/Config|1|http://curl.haxx.se/docs/manpage.html^0|0|25|2C|0|0|1L|2|0|7|11|1|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|W|8|@]|9|@$D|X|E|Y|1|Z]]|A|$]]|$1|F|3|G|5|6|7|10|8|@$D|11|E|12|H|I]]|9|@]|A|$]]|$1|J|3|K|5|6|7|13|8|@]|9|@$D|14|E|15|1|16]]|A|$]]|$1|L|3|-4|5|6|7|17|8|@]|9|@]|A|$]]]|M|$N|$5|O|P|Q|A|$R|S]]|T|$5|O|P|Q|A|$R|U]]]]

Disclaimer: I'm not a 100% this is possible in the way your describing without hacking up Authlogic's core functionality. 

The first issue your going to have is that authlogic prevents the use of SSO tokens for authentication unless the request is ATOM or RSS to override this you need to pass a config paramater see here: <a href="http://rdoc.info/github/binarylogic/authlogic/master/Authlogic/Session/Params/Config" rel="nofollow">http://rdoc.info/github/binarylogic/authlogic/master/Authlogic/Session/Params/Config</a>

To the core issue: I don't see any 'easy' way to handle this functionality, however what you could do for something like curl is pass the user token as a paramater (using the <code>-G</code> option) just like you would when visiting the url.

cURL Documentation: <a href="http://curl.haxx.se/docs/manpage.html" rel="nofollow">http://curl.haxx.se/docs/manpage.html</a>

blocks|key|1964858|text|如果您正在实现一个API，您可以考虑构建一个单独的Rack应用程序，然后安装在‘/api/1.0/.’分享你的模特。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1964859|这样，您就不会将您的API直接与您的公共路线联系起来，这对于API用户来说可能很难构建。|1964860|一种很好的方法是创建一个简单的Sinatra应用程序，它只公开您想要的方法，然后创建一个单独的身份验证策略：|1964861|require+'sinatra'++++
require+'active_support'+#+all+the+Rails+stuff
require+'lib/user'+#+your+User+class
require+'sinatra/respond_to'+#+gem+install+sinatra-respond_to

Sinatra::Application.register+Sinatra::RespondTo

use+Rack::Auth::Basic,+"API",+do+%7Cusername,+password%7C
++User.find_by_login(username).valid_password?(password)
end

get+'/api/1.0/posts'+do
++@posts+=+Post.recent+#+assuming+you+have+a+Post+model...

++respond_to+do+%7Cwants%7C
++++wants.xml+{+@posts.to_xml+}
++++wants.to_json+{+@posts.to_json+}
++end
end

get+'/api/1.0/users/:id'+do
++@user+=+User.find_by_login(params[:id])

++#+Careful+here+-+don't+release+personal+details!
++respond_to+do+%7Cwants%7C
++++wants.xml+{+@user.to_xml+}
++++wants.to_json+{+@user.to_json+}
++end
end|code-block|syntax|javascript|1964862|在路径中使用'1.0‘(或类似的)对API进行版本化意味着，如果更改模型，则可以创建API的新版本，而不会破坏用户的现有代码。|1964863|使用它，您应该能够允许用户使用HTTP形式进行身份验证：|1964864|curl+-u+steven:password+http://example.com/api/1.0/users/steven.xml
curl+-u+steven:password+http://example.com/api/1.0/users/steven.json
curl+-u+steven:password+http://example.com/api/1.0/posts.xml|1964865|要使其运行，请将其保存为'api.rb'，或者将其作为Rack中间件运行，或者创建一个'config.ru‘文件，如下所示：|1964866|require+'api'
run+Sinatra::Application|1964867|然后从那个目录：|1964868|rackup|1964869|entityMap^0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|11|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|12|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|13|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|14|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|15|8|@]|9|@]|A|$]]|$1|O|3|P|5|H|7|16|8|@]|9|@]|A|$I|J]]|$1|Q|3|R|5|6|7|17|8|@]|9|@]|A|$]]|$1|S|3|T|5|H|7|18|8|@]|9|@]|A|$I|J]]|$1|U|3|V|5|6|7|19|8|@]|9|@]|A|$]]|$1|W|3|X|5|H|7|1A|8|@]|9|@]|A|$I|J]]|$1|Y|3|-4|5|6|7|1B|8|@]|9|@]|A|$]]]|Z|$]]

If you're implementing an API, you could consider building a separate Rack application that is then mounted at '/api/1.0/...' and shares your models. 

That way you are not tying yourself into having your API directly related to your public routes, which could be difficult to construct for the API user.

A good approach would be to create a simple Sinatra application that exposes just the methods that you want, and to then create a separate authentication strategy:

<pre><code>require 'sinatra' 
require 'active_support' # all the Rails stuff
require 'lib/user' # your User class
require 'sinatra/respond_to' # gem install sinatra-respond_to

Sinatra::Application.register Sinatra::RespondTo

use Rack::Auth::Basic, "API", do |username, password|
 User.find_by_login(username).valid_password?(password)
end

get '/api/1.0/posts' do
 @posts = Post.recent # assuming you have a Post model...

 respond_to do |wants|
 wants.xml { @posts.to_xml }
 wants.to_json { @posts.to_json }
 end
end

get '/api/1.0/users/:id' do
 @user = User.find_by_login(params[:id])

 # Careful here - don't release personal details!
 respond_to do |wants|
 wants.xml { @user.to_xml }
 wants.to_json { @user.to_json }
 end
end
</code></pre>

Versioning your API with a '1.0' (or similar) in the path means that if you change your models you can create a new version of your API without breaking your users' existing code.

Using this you should be able to allow users to authenticate with HTTP Basic in the form:

<pre><code>curl -u steven:password http://example.com/api/1.0/users/steven.xml
curl -u steven:password http://example.com/api/1.0/users/steven.json
curl -u steven:password http://example.com/api/1.0/posts.xml
</code></pre>

To get this running, save it as 'api.rb', and either run it as a Rack Middleware, or create a 'config.ru' file like so:

<pre><code>require 'api'
run Sinatra::Application
</code></pre>

And then from that directory:

<pre><code>rackup
</code></pre>

blocks|key|2322397|text|如果我误解了你的问题，请原谅我，但我认为答案很简单：“不”。你把这两个比喻混在一起。如果您想要一个安全的API密钥，请使用单个访问令牌；如果您想使用https身份验证，则需要一个不同的base64字形--而且https并不特别安全(除非在https上使用，这通常并不实用)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2322398|更详细的是：|2322399|根据维基百科，http基本身份验证旨在提供一个简单、标准但相当不安全的base64编码字形的用户名和密码。|offset|length|2322400|要使用基本的auth，那么我相信您希望通过一个简单的|2322401|Base64.encode64("#{user.name}:#{password}")|code-block|syntax|javascript|2322402|...and+--我可能会通过让用户键入他们的密码来做到这一点，因为您无法从authlogic存储在数据库中的crypted_password中派生密码。|2322403|但其结果是，这是一个非常不同的野兽与single_access_token，两者不能混为一谈。|2322404|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Basic_access_authentication^0|0|0|7|A|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|11|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|12|8|@]|9|@$F|13|G|14|1|15]]|A|$]]|$1|H|3|I|5|6|7|16|8|@]|9|@]|A|$]]|$1|J|3|K|5|L|7|17|8|@]|9|@]|A|$M|N]]|$1|O|3|P|5|6|7|18|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|19|8|@]|9|@]|A|$]]|$1|S|3|-4|5|6|7|1A|8|@]|9|@]|A|$]]]|T|$U|$5|V|W|X|A|$Y|Z]]]]

Forgive me if I misunderstand your question, but I think the answer is a simple "no." You're mixing two metaphors here. If you want a secure API key, use the single access token; if you want to use http basic access authentication, you need a different base64 glyph -- and http basic auth isn't particularly secure (unless used over https, which isn't generally practical).

In more detail:

Per the wikipedia, <a href="http://en.wikipedia.org/wiki/Basic_access_authentication" rel="nofollow">http basic authentication</a> is intended to provide a username and password in a simple, standard, but fairly insecure base64 encoded glyph.

To use basic auth, then I believe you want to generate the glyph via a simple 

<pre><code>Base64.encode64("#{user.name}:#{password}")
</code></pre>

...and I'd probably do this by having the user type their password, since you can't derive the password from the crypted_password that authlogic stores in your database.

But the upshot is that this is a very different beast from the single_access_token, and the two can't be mixed.

I'm using Authlogic and Rails 3. On top of the regular browser-based user experience (logging in via form and whatnot), I'd like to implement an API.

Authlogic seems to support single access tokens that don't persist by default. I supply them by adding a GET argument as in:

<pre><code>/users.xml?user_credentails=my_single_access_token
</code></pre>

Question: Is there any way I can have Authlogic accept the API key via HTTP Basic Auth? <a href="http://developer.37signals.com/highrise/" rel="nofollow">Highrise</a> does something just like this, allowing for:

<pre><code>curl -u 605b32dd:X http://sample.highrisehq.com/people/1.xml
</code></pre>

The same with <a href="http://developers.freshbooks.com/" rel="nofollow">Freshbooks</a>:

<pre><code>curl -u insert_token_here:X https://sample.freshbooks.com/api/2.1/xml-in -d '[xml body here]'
</code></pre>

How I would go about imitating this functionality? I can't even figure out where the input data (postdata from forms, HTTP basic, API token) are taken in. I've boiled it down to a call to <code>UserSessions.find</code> with no arguments, but I lose track of it after there.

Any help would be much appreciated!

Related question: I'd also like to disable session persistence (make it so that no cookie is stored) if HTTP basic is used. Any help on this too would be appreciated!

Prevent Authlogic from establishing a session/cookie for non-HTML requests

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我使用Authlogic和Rails 3，在常规的基于浏览器的用户体验之上(通过表单登录等等)，我想实现一个API。Authlogic似乎支持默认不持久化的单个访问令牌。我通过添加GET参数来提供它们，如下所示：/users.xml?user_credentails=my_single_access_token问题：是...

问防止Authlogic为非HTML请求建立会话/cookie
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问防止Authlogic为非HTML请求建立会话/cookieEN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问防止Authlogic为非HTML请求建立会话/cookie
EN