# Restful\_authentication as a web service?

**URL:** <https://www.ruby-forum.com/t/restful-authentication-as-a-web-service/174007>\
**Category:** Rails\
**Created:** [August 19, 2009, 9:10am UTC](https://www.ruby-forum.com/t/restful-authentication-as-a-web-service/174007 "2009-08-19T09:10:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![drenovac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@drenovac](https://www.ruby-forum.com/u/drenovac)\
**Post date:** [August 19, 2009, 9:10am UTC](https://www.ruby-forum.com/t/restful-authentication-as-a-web-service/174007/1 "2009-08-19T09:10:54Z")

</div>

Hey everyone,

I have been using Ruby on Rails for a few months now (I come from a  
php / Java/J2EE background) and have been LOVING it. I do have one  
question regarding XML output and the SessionsController#create method  
that is generated by the restful authentication plugin.

I added the following code to the create method:

```
  #if login is successful

  respond_to do |format|
    format.html { redirect_back_or_default('/')}# index.html.erb
    format.xml { render :xml => self.current_user }
  end

#if login is not successful

  respond_to do |format|
    format.html { render :action => 'new'}# index.html.erb
    format.xml { response.status_code.should == 401 }
  end

When I try to test this like this:

```

[http://localhost:3000/sessions/create?login=myuser&password=mypassword](http://localhost:3000/sessions/create?login=myuser&password=mypassword)  
I am able to login successfully. If I add .xml to the end of create  
like this:  
[http://localhost:3000/sessions/create.xml?login=myuser&password=mypassword](http://localhost:3000/sessions/create.xml?login=myuser&password=mypassword)  
I get the following exception: No route matches “/sessions/create.xml”  
with {:method=\>:get}. My routes.rb is pretty generic (has all of the  
restful authentication mappings) and I haven’t touched it. Any ideas  
as to what I’m doing wrong? How can I log in to my site from a 3rd  
party client?

Thanks,  
Mark Dinstuhl

---

<div class="post-metadata">

**Author:** ![drenovac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@drenovac](https://www.ruby-forum.com/u/drenovac)\
**Post date:** [August 19, 2009, 10:01am UTC](https://www.ruby-forum.com/t/restful-authentication-as-a-web-service/174007/2 "2009-08-19T10:01:15Z")

</div>

The format is determined by the HTTP Accept header, and not by adding  
an extension on the URL.  
So, your url remains /sessions/create and not /sessions/create.xml

You can test this out by using a command line tool like curl. For  
example:

curl -H “Accept: application/xml” “[http://localhost:3000/sessions/](http://localhost:3000/sessions/)  
create?login=xxx&password=xxx”

This should return your xml.

---

<div class="post-metadata">

**Author:** ![drenovac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@drenovac](https://www.ruby-forum.com/u/drenovac)\
**Post date:** [August 19, 2009, 1:31pm UTC](https://www.ruby-forum.com/t/restful-authentication-as-a-web-service/174007/3 "2009-08-19T13:31:59Z")

</div>

You can use the RestfulClient gem to test it out instead of CURL.

---

<div class="post-metadata">

**Author:** ![drenovac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@drenovac](https://www.ruby-forum.com/u/drenovac)\
**Post date:** [August 19, 2009, 10:55pm UTC](https://www.ruby-forum.com/t/restful-authentication-as-a-web-service/174007/4 "2009-08-19T22:55:16Z")

</div>

hitch wrote:

> The format is determined by the HTTP Accept header, and not by adding  
> an extension on the URL.  
> So, your url remains /sessions/create and not /sessions/create.xml

Wait a moment. The URI is actually /sessions not /sessions/create. The  
HTTP verb is used to select the create method: POST  
[http://localhost:3000/sessions](http://localhost:3000/sessions) would route the request to the create  
method in the controller.

---

<div class="post-metadata">

**Author:** ![drenovac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@drenovac](https://www.ruby-forum.com/u/drenovac)\
**Post date:** [August 21, 2009, 2:02am UTC](https://www.ruby-forum.com/t/restful-authentication-as-a-web-service/174007/5 "2009-08-21T02:02:29Z")

</div>

Larry,

Thank you SO much for answering my question. If anyone is  
wondering, THIS WORKED.

Have a good one!  
Martin Dinstuhl