# RESTful Authentication for external clients

**URL:** <https://www.ruby-forum.com/t/restful-authentication-for-external-clients/138842>\
**Category:** Rails\
**Created:** [May 28, 2008, 9:17am UTC](https://www.ruby-forum.com/t/restful-authentication-for-external-clients/138842 "2008-05-28T09:17:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sameera](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/b487fb/32.png) [@sameera](https://www.ruby-forum.com/u/sameera)\
**Post date:** [May 28, 2008, 9:17am UTC](https://www.ruby-forum.com/t/restful-authentication-for-external-clients/138842/1 "2008-05-28T09:17:00Z")

</div>

Hi All,

I have created a RESTful web api and it works fine. I have manage to use  
RESTFul authentication also.

My problem is, how can i implement authentication for external clients.

Ex : If my Web service is consumed by a desktop application, how will i  
be able to implement authentication. ?!!

Is there any standard way or how can i get this done  
Please advice me

thankx in advance

cheers  
sameera

---

<div class="post-metadata">

**Author:** ![sameera](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/b487fb/32.png) [@sameera](https://www.ruby-forum.com/u/sameera)\
**Post date:** [May 29, 2008, 5:52am UTC](https://www.ruby-forum.com/t/restful-authentication-for-external-clients/138842/2 "2008-05-29T05:52:10Z")

</div>

Hi Sameera,

That should work out of the box. In the simplest case, use a  
before\_filter :login\_required ( this is described in lib/  
authenticated\_system.rb) to restrict access to any set of controller  
actions, and use HTTP basic authentication from the remote end  
(requesting .xml, .json, etc). If you look in lib/  
authenticated\_system.rb this is tried after login\_by\_session and  
login\_by\_cookie for any page request that expects a current\_user. If  
you’d like to know more on HTTP basic auth there’s an excellent  
(natch) railscast here: [#82 HTTP Basic Authentication - RailsCasts](http://railscasts.com/episodes/82) and I’m sure  
google will have one or two links for you.

One thing to watch out for: if you use any kind of activation/email  
validation/etc the current version of restful\_authentication doesn’t  
check that the user is active, only that their password  
authenticates. I’ve handled that by routing all non-session logins  
through a single become\_logged\_in\_as! method; it raises an exception  
if the user isn’t authorized to login.

Cheers,  
flip

On May 28, 2:17 am, Sameera G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)