Proposal: Authentication via JWT token

rubyonrails-core
1

hi there. I recently tested authentication generator on a brand new project, and despite the feature being really useful, I need to use a JWT token as Authorization header rather than a cookie. I propose to add an option, token, to the generator.

Using only token option generate a JWT token and provide it as a query param to views. Using both token and api options generate a JWT token and render it as a response, fully decorrelating authentication from views.

I already worked on it, you can see the diff : Comparing rails:main...xamey:authentication/add-token-option · rails/rails · GitHub

I follow CONTRIBUTING.md before opening a pull request, so here I am. Eager to read your feedbacks.

2 Likes
3

Is jwt part of the Ruby standard library now? I see your generator depends on it. Or is the assumption that people usign this should have it as part of their gemfile already

4

I would really like to see something like this. Has the core team mentioned anything regarding if they’d accept something like this?

5

You’re right, I forgot that. I should add jwt dependency to Rails then. Thanks for pointing that out!

6

First time I use that forum before creating the pull request so I don’t know if i have to wait for a core member to approve.

7

Oh I don’t know either. This is my first time being active in the forum since I joined 13 years ago. I think someone would get through to the pull request at some point

8

I added jwt gem to the Gemfile, as it is needed for that new blueprint.

9

Yup, I’ll wait a week or more.

10

I created the pull request: Add token option to authentication generator by xamey · Pull Request #54279 · rails/rails · GitHub

11

Well, it has been closed. “Thank you for the pull request but it is by design that the authentication generator is simple and don’t cover all the use cases. We don’t want to complicate its logic. We will not be accepting new ways of authenticating.”

12

Why can’t you write your own generator that either extends or overwrites the Rails generator to do this? This definitely feels like an optional feature that could be provided by a separate gem.

13

Thanks for the advice, I may do that.