# RESTful Authentication

**URL:** <https://www.ruby-forum.com/t/restful-authentication/87388>\
**Category:** Rails\
**Created:** [March 2, 2007, 5:53am UTC](https://www.ruby-forum.com/t/restful-authentication/87388 "2007-03-02T05:53:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [March 2, 2007, 5:53am UTC](https://www.ruby-forum.com/t/restful-authentication/87388/1 "2007-03-02T05:53:32Z")

</div>

I’ve seen the RESTful Authentication plugin that Rick Olsen has, and  
was wondering if anyone has used it, or can answer my questions:

1. What does RESTful Authentication really mean? How does CRUD fit  
into this?

Create - Create new user  
Read - What does it mean to ‘read’ a user?  
Update - Change the user name, etc?  
Destroy - Remove user account

Seems like you would have to have a session id anyways, otherwise how  
do you authorize?

1. How do sessions fit into CRUD? Is the session the object of the  
CRUD, as opposed to a user?

2. What’s the benefit of this over acts\_as\_authenticated?

Thanks!

---

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [March 2, 2007, 6:21am UTC](https://www.ruby-forum.com/t/restful-authentication/87388/2 "2007-03-02T06:21:33Z")

</div>

I’m still a newb but I’ll answer to the best of my ability.  
Authorization is enforced using a before\_filter set to certain  
controller’s and actions of your choice. The advantage over  
acts\_as\_authenticated, that I see as a newb, is your getting rid of  
the admin controller. Less code for the same function is always  
better.

---

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [March 2, 2007, 4:27pm UTC](https://www.ruby-forum.com/t/restful-authentication/87388/3 "2007-03-02T16:27:35Z")

</div>

On Mar 1, 2007, at 11:48 PM, Yottameter wrote:

> Seems like you would have to have a session id anyways, otherwise  
> how do you authorize?

The restful\_authentication plugin adds a couple of things over  
acts\_as\_authenticated.

One is refactoring users and sessions to follow CRUD conventions.  
Your list above is about right. ‘Read’ isn’t enabled by default, but  
could be used, for example, to show a user’s profile page.

The other thing that it adds is support for HTTP authentication of  
web service requests, which is the most standard way to do  
authentication for RESTful APIs. That’s the real benefit of this  
plugin over acts\_as\_authenticated imho – the same code will now  
handle both your standard login page and your API.

> 1. How do sessions fit into CRUD? Is the session the object of the  
> CRUD, as opposed to a user?

You can create/destroy sessions just as you would any other resource.

In restful\_authentication for standard web pages (ie. not using the  
API) that will usually create a cookie which is used to store your  
session ID just like in acts\_as\_authenticated.

James.

–  
James S.  
Play: [http://james.anthropiccollective.org](http://james.anthropiccollective.org)  
Work: [Processing Greenbelt 2009 – James Stewart](http://jystewart.net/process/)