ruby on rails - authenticate_or_request_with_http_token fails even when the token matches -
def restrict_access # raise apikey.exists?(access_token: params[:token]).to_s authenticate_or_request_with_http_token |token, options| apikey.exists?(access_token: token) end end
apikey.exists?(access_token: token)
returns true
, yet every time def called returns http token: access denied.
, have no idea why. can hard code correct token , still fails. seems in dev , test, works in prod scares me. started happening seemingly out of blue. can't debug within authenticate_or_request_with_http_token block, it's kicking me out before apikey.exists?() executed.
i've looked @ source it's not helpful me. https://github.com/rails/rails/blob/04cda1848cb847c2bdad0bfc12160dc8d5547775/actionpack/lib/action_controller/metal/http_authentication.rb#l393
there note in docs, maybe have problem:
on shared hosts, apache doesn’t pass authentication headers fcgi instances. if environment matches description , cannot authenticate, try rule in apache setup:
rewriterule ^(.*)$ dispatch.fcgi [e=x-http_authorization:%{http:authorization},qsa,l]
http://api.rubyonrails.org/classes/actioncontroller/httpauthentication/token.html
Comments
Post a Comment