ruby-on-rails - Ruby on Rails : can I use http basic auth in constraints?

Question

我使用 Rails 5 API 模式

路线.rb:

Rails.application.routes.draw do      
  constraints Basic do
    mount Rswag::Ui::Engine  => '/api-docs'
    mount Rswag::Api::Engine => '/api-docs'
    mount Sidekiq::Web       => '/sidekiq'
    # etc
  end
end

约束/基本.rb:

class Basic
  def self.matches?(request)
    authenticate_or_request_with_http_basic do |email, password|
      email == 'foo' && password = 'bar'
    end
  end
end

但我收到一个错误:

NoMethodError (undefined method `authenticate_or_request_with_http_basic' for Basic:Class)

我可以在约束中使用 http 基本身份验证吗？

Answer 1

我不认为你可以使用 authenticate_or_request_with_http_basic 超出 Controller 范围的方法。您可以设置before_filter在通用 Controller 中进行身份验证检查。这是取自 docs comments 的示例:

class AdminController < ApplicationController
  before_filter :authenticate

  def authenticate
    authenticate_or_request_with_http_basic('Administration') do |email, password|
      email == 'foo' && password == 'bar'
    end
  end
end

这也是我发现的 Rails Authentication Routing Constraints Considered Harmful .

话虽如此，我认为有一种方法:

class Basic
  def self.matches?(request)
    if ActionController::HttpAuthentication::Basic.has_basic_credentials?(request)
      credentials = ActionController::HttpAuthentication::Basic.decode_credentials(request)
      email, password = credentials.split(':')

      email == 'foo' && password == 'bar'
    end
  end
end

Here is docs on HTTP Basic authentication有例子