This blog will help you to set up simple JWT authentication solution for your Rails API. However, i have implemented many authentication solutions in our projects, but i personally felt that JWT is best and secured web token and that provides an easy way to handle the information shared between the client and server. On this blog, let’s see how we can implement JWT for authentication and to transfer information between resources.

What Is JWT?

JSON Web Token (JWT) is a JSON-based open standard (RFC 7519) for creating access tokens.
JWT consists of three parts and its basically separated by dots,

• Header
• Payload
• Signature

Header – Header is the first part of the JWT token, It consists of two things, One is the type of algorithm used to generate signature and second is the type of token.
Payload – Payload is the second part of the JWT token. It consists of information about the entity.
Signature – Payload is the third part of the JWT token, It is calculated by base64url encoding the header and payload.

How to implement JWT in Rails application?

 

Step: 1 – First create a new rails application

rails new app

 

Step: 2 – Add the jwt gem into Gemfile.

gem 'jwt'

 

Also Read: Caching In Ruby On Rails 5.2

 

Step: 3 – Create JWT service file

Create JsonWebToken class under lib/json_web_token.rb file. This will be used to create and validate the jwt token.
JsonWebToken’s encode method is used to create JWT token by using payload and secret key.
JsonWebToken’s decode method is used to decode the token to convert payload using secret key.

class JsonWebToken
def self.encode(payload)
JWT.encode(payload, ENV["SECRET_KEY_BASE"])
end
def self.decode(token)
return HashWithIndifferentAccess.new(JWT.decode(token, ENV["SECRET_KEY_BASE"])[0])
rescue
nil
end
end

 

Step: 3 – Create users and jwt_tokens table.

Here the below tables used to handle user and session tokens.
users – Used to store user details and login information.

create_table "users" do |t|
t.string "first_name"
t.string "email", default: "", null: false
t.string "encrypted_password", default: "", null: false
t.string "api_key", null: false
end

Jwt_tokens – Used to store the sessions details and jwt tokens.

create_table "jwt_tokens" do |t|
t.bigint "user_id"
t.string "token"
end

 

Related: 10 Useful Ruby On Rails Gems We Couldn’t Live Without

 

Step: 4 – Create a rails model for above tables

 

1. Add User under app/models/user.rb

Each users will have unique API_KEY, also each user will have many jwt tokens. Usually, these JWT tokens are stored in jwt_tokens table.

class User < ApplicationRecord
# Validations
validates :first_name, :last_name, :email, presence: true
validates :email, uniqueness: true
# associations
has_many :jwt_tokens
def assign_api_key
self.api_key = SecureRandom.uuid
end
end

 

2. Add JwtToken under app/models/jwt_token.rb

 

class JwtToken < ApplicationRecord
belongs_to :user
end

 

Step: 5 – Create sessions API to create JWT

In sessions, API validates the user authentication, and it will create the jwt token using JsonWebToken class. JWT token will be stored in a jwt_tokens table along with api_key. These tokens will be used to verify the further requests.

# sessions controller
require 'json_web_token'
class SessionsController < Devise::SessionsController
    def create
        user = User.find_for_database_authentication(email: params[:user][:email])
            if user && user.valid_password?(params[:user][:password])
                render json: payload(user, params)
            else
                render json: {success: false, message: 'Invalid details' }, status: :unauthorized
            end
    end
    private
        def payload(user, params = {})
            jwt_token = user.jwt_tokens.create(token: SecureRandom.uuid)
  	{
    	    api_key: user.api_key,
    	    auth_token: JsonWebToken.encode({token: jwt_token.token})
  	}
        end
end

 

Step: 6 – Create User details API to use JWT token as a session token

In user details API the jwt token is passed through headers, and the tokens are decoded using JsonWebToken class. The decoded token is validated against the stored token and this is how the session will be maintained between client and server.

# users controller
require 'json_web_token'
class UsersController < Devise::SessionsController
    # validate the session using JWT token
    before_action :authenticate_request!
    def show
        render json: { success: true, user: @user }
    end
    def authenticate_request!
        token = JsonWebToken.decode(request.headers['Authorization'])
        @user = User.joins(:jwt_tokens).where('jwt_tokens.token =?', token).last
        render json: { error: 'You are not authorized' }, status: :401 unless token || @user
    end
end

So far i have covered the process of creating sessions using JWT and also the procedure of handling sessions. Hopefully you can use JWT for creating secured tokens to protect your web services.
Hope this helps you! Similarly you can learn more on interesting on latest technologies, never miss out anything from our largest blog portal where you can get continuous blog updates & latest posts about all the latest technologies which would be perfect for your 15 minutes tea break! In case if you’re a newbie then don’t forget to subscribe us to get the latest updates from diverse technologies. What else guys hit the subscribe link and go crazy over learning.
For more inquires reach us via info@agiratech.com