# Session auth and AWS auth

**URL:** <https://www.ruby-forum.com/t/session-auth-and-aws-auth/125024>\
**Category:** Rails\
**Created:** [January 4, 2008, 5:19pm UTC](https://www.ruby-forum.com/t/session-auth-and-aws-auth/125024 "2008-01-04T17:19:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ADADAD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/85e7bf/32.png) [@ADADAD](https://www.ruby-forum.com/u/ADADAD)\
**Post date:** [January 4, 2008, 5:19pm UTC](https://www.ruby-forum.com/t/session-auth-and-aws-auth/125024/1 "2008-01-04T17:19:13Z")

</div>

Hello  
I have 2 applications (1 normal, 1 Beast Forum) that set the session  
domain  
to be the same so that they can share information between them (they use  
the  
same database). However, i am not 100% clear on how I can expose the  
controller methods to each of them through normal HTTP Auth, and keep  
the  
normal acts\_as\_authenticated pieces in place at the same time?

Is there a way to distinguish web-service calls through AWS from normal  
browser call and authenticate them differently ?

Thanks  
Adam

---

<div class="post-metadata">

**Author:** ![ADADAD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/85e7bf/32.png) [@ADADAD](https://www.ruby-forum.com/u/ADADAD)\
**Post date:** [January 4, 2008, 5:33pm UTC](https://www.ruby-forum.com/t/session-auth-and-aws-auth/125024/2 "2008-01-04T17:33:54Z")

</div>

On 4 Jan 2008, at 16:18, AD wrote:

> Is there a way to distinguish web-service calls through AWS from  
> normal  
> browser call and authenticate them differently ?

I’ve done this in 2 ways:

- Have the web service actions behind a filter that effectively says  
‘localhost only’ (or local subnet only if you have several machine on  
a private network)
- Normal requests arrive on port 80, have a apache set an http header  
for you (eg ‘EXTERNAL\_REQUEST’), have web service requests arrive on  
some other port (eg 81) and don’t set that. Only allow web-service  
requests if EXTERNAL\_REQUEST is not set (and let the firewall take  
care of not allowing anyone else query you on port 81)

Fred

---

<div class="post-metadata">

**Author:** ![ADADAD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/85e7bf/32.png) [@ADADAD](https://www.ruby-forum.com/u/ADADAD)\
**Post date:** [January 4, 2008, 5:36pm UTC](https://www.ruby-forum.com/t/session-auth-and-aws-auth/125024/3 "2008-01-04T17:36:52Z")

</div>

Thanks, the first option doest really work if the app and the WS need to  
use  
the same action.  
How do you actually handle authentication? I assume you dont use  
acts\_as\_authenticated, do you use this new http\_authentication method?

On Jan 4, 2008 11:33 AM, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![ADADAD](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/85e7bf/32.png) [@ADADAD](https://www.ruby-forum.com/u/ADADAD)\
**Post date:** [January 4, 2008, 5:48pm UTC](https://www.ruby-forum.com/t/session-auth-and-aws-auth/125024/4 "2008-01-04T17:48:06Z")

</div>

On 4 Jan 2008, at 16:36, AD wrote:

> Thanks, the first option doest really work if the app and the WS  
> need to use the same action.

Ah I hadn’t got that

> How do you actually handle authentication? I assume you dont use  
> acts\_as\_authenticated, do you use this new http\_authentication method?

I’ve got some home grown stuff (session stuff). It’s never for us the  
case that an action is accessed in both ways.

I think what I outline below still helps. acts\_as\_authenticated gives  
you a login\_required filter. You could instead have a filter that  
looks like

def web\_service\_or\_login  
login\_required unless is\_a\_web\_service\_request?  
end

Where is\_a\_web\_service\_request? determines whether the request is one  
from a webservice (possibly using one of the thigns I described).

Fred