Concerns

This gem includes a Rails concern called DeviseTokenAuth::Concerns::SetUserByToken. Include this concern to provide access to controller methods such as authenticate_user!, user_signed_in?, etc.

The concern also runs an after_action that changes the auth token after each request.

It is recommended to include the concern in your base ApplicationController so that all children of that controller include the concern as well.

Concern example:

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  include DeviseTokenAuth::Concerns::SetUserByToken
end

Methods

This gem provides access to all of the following devise helpers:

Note that if the model that you're trying to access isn't called User, the helper method names will change. For example, if the user model is called Admin, the methods would look like this:

• before_action :authenticate_admin!

• admin_signed_in?

• current_admin

Example: limit access to authenticated users

# app/controllers/test_controller.rb
class TestController < ApplicationController
  before_action :authenticate_user!
​
  def members_only
    render json: {
      data: {
        message: "Welcome #{current_user.name}",
        user: current_user
      }
    }, status: 200
  end
end

Token Header Format

The authentication information should be included by the client in the headers of each request. The headers follow the RFC 6750 Bearer Token format:

Authentication headers example:

"access-token": "wwwww",
"token-type":   "Bearer",
"client":       "xxxxx",
"expiry":       "yyyyy",
"uid":          "zzzzz"

The authentication headers (each one is a seperate header) consists of the following params:

The authentication headers required for each request will be available in the response from the previous request. If you are using the ng-token-auth AngularJS module or the jToker jQuery plugin, this functionality is already provided.