# Problem with authentication... Acts As Authenticated

**URL:** <https://www.ruby-forum.com/t/problem-with-authentication-acts-as-authenticated/149635>\
**Category:** Rails\
**Created:** [September 27, 2008, 1:27am UTC](https://www.ruby-forum.com/t/problem-with-authentication-acts-as-authenticated/149635 "2008-09-27T01:27:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![julien51](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/91b2a8/32.png) [@julien51](https://www.ruby-forum.com/u/julien51)\
**Post date:** [September 27, 2008, 1:27am UTC](https://www.ruby-forum.com/t/problem-with-authentication-acts-as-authenticated/149635/1 "2008-09-27T01:27:39Z")

</div>

Hello,

I am working on the API of our webservice. API users need to  
authenticate some of their calls…  
When I am performig the call through Firefox, everything is fine as  
shown in the log :

Processing OwnershipsController#new (for 67.207.118.174 at 2008-09-26  
16:20:03) [GET]  
Session ID:  
BAh7BiIKKmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo  
SGFzaHsABjoKQHVzZWR7AA==–5a5630c016ccd9482ce679e272d3d53adea86595  
Parameters: {“format”=\>“xml”, “action”=\>“new”,  
“controller”=\>“sources/ownerships”, “password”=\>“MYPASS”,  
“login”=\>“MYUSER”, “source\_id”=\>“1247”}  
Completed in 0.01454 (68 reqs/sec) | Rendering: 0.00705 (48%) | DB:  
0.00378 (25%) | 200 OK  
[[http://site.com/sources/1247/ownerships/new.xml?login=](http://site.com/sources/1247/ownerships/new.xml?login=)  
MYUSER&password=MYPASS]

However, if I perform the exact same call from an external client  
wirtten in Perl, here is what I get n my log :

Processing OwnershipsController#new (for 67.202.41.41 at 2008-09-26  
16:19:39) [GET]  
Session ID: 6ef6e5b8289004d925517d48294f1cc1  
Parameters: {“format”=\>“xml”, “action”=\>“new”,  
“controller”=\>“sources/ownerships”, “password”=\>“MYPASS”,  
“login”=\>“MYUSER”, “source\_id”=\>“1247”}  
Filter chain halted as [:login\_required] rendered\_or\_redirected.  
Completed in 0.00284 (351 reqs/sec) | Rendering: 0.00066 (23%) | DB:  
0.00000 (0%) | 401 Unauthorized  
[[http://site.com/sources/1247/ownerships/new.xml?login=MYUSER&password=MYPASS](http://site.com/sources/1247/ownerships/new.xml?login=MYUSER&password=MYPASS)]

As you can see the parameters are precisely the same and, in one case,  
the call is successful while in another case it’s not!

Do you guys have any idea on how to solve this?

Thanks a lot!

---

<div class="post-metadata">

**Author:** ![julien51](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/91b2a8/32.png) [@julien51](https://www.ruby-forum.com/u/julien51)\
**Post date:** [September 27, 2008, 1:34am UTC](https://www.ruby-forum.com/t/problem-with-authentication-acts-as-authenticated/149635/2 "2008-09-27T01:34:20Z")

</div>

Firefox

> Session ID:  
> BAh7BiIKKmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo  
> SGFzaHsABjoKQHVzZWR7AA==–5a5630c016ccd9482ce679e272d3d53adea86595

Perl

> Session ID: 6ef6e5b8289004d925517d48294f1cc1

Give the vast difference between these two Session IDs it makes me  
wonder if that is related to you problem? Does this relate in any way to  
“cross-site forgery protection?”

Julien Genestoux wrote:

> Hello,
> 
> I am working on the API of our webservice. API users need to  
> authenticate some of their calls…  
> When I am performig the call through Firefox, everything is fine as  
> shown in the log :
> 
> Processing OwnershipsController#new (for 67.207.118.174 at 2008-09-26  
> 16:20:03) [GET]  
> Session ID:  
> BAh7BiIKKmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo  
> SGFzaHsABjoKQHVzZWR7AA==–5a5630c016ccd9482ce679e272d3d53adea86595  
> Parameters: {“format”=\>“xml”, “action”=\>“new”,  
> “controller”=\>“sources/ownerships”, “password”=\>“MYPASS”,  
> “login”=\>“MYUSER”, “source\_id”=\>“1247”}  
> Completed in 0.01454 (68 reqs/sec) | Rendering: 0.00705 (48%) | DB:  
> 0.00378 (25%) | 200 OK  
> [[http://site.com/sources/1247/ownerships/new.xml?login=](http://site.com/sources/1247/ownerships/new.xml?login=)  
> MYUSER&password=MYPASS]
> 
> However, if I perform the exact same call from an external client  
> wirtten in Perl, here is what I get n my log :
> 
> Processing OwnershipsController#new (for 67.202.41.41 at 2008-09-26  
> 16:19:39) [GET]  
> Session ID: 6ef6e5b8289004d925517d48294f1cc1  
> Parameters: {“format”=\>“xml”, “action”=\>“new”,  
> “controller”=\>“sources/ownerships”, “password”=\>“MYPASS”,  
> “login”=\>“MYUSER”, “source\_id”=\>“1247”}  
> Filter chain halted as [:login\_required] rendered\_or\_redirected.  
> Completed in 0.00284 (351 reqs/sec) | Rendering: 0.00066 (23%) | DB:  
> 0.00000 (0%) | 401 Unauthorized  
> [[http://site.com/sources/1247/ownerships/new.xml?login=MYUSER&password=MYPASS](http://site.com/sources/1247/ownerships/new.xml?login=MYUSER&password=MYPASS)]
> 
> As you can see the parameters are precisely the same and, in one case,  
> the call is successful while in another case it’s not!
> 
> Do you guys have any idea on how to solve this?
> 
> Thanks a lot!