# Web services and dealing with before\_filter

**URL:** <https://www.ruby-forum.com/t/web-services-and-dealing-with-before-filter/58474>\
**Category:** Rails\
**Created:** [April 21, 2006, 11:45pm UTC](https://www.ruby-forum.com/t/web-services-and-dealing-with-before-filter/58474 "2006-04-21T23:45:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![danielb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c57346/32.png) [@danielb](https://www.ruby-forum.com/u/danielb)\
**Post date:** [April 21, 2006, 11:45pm UTC](https://www.ruby-forum.com/t/web-services-and-dealing-with-before-filter/58474/1 "2006-04-21T23:45:26Z")

</div>

Hi all,

I’ve got a Rails app with a ApplicationController that looks like this:

class ApplicationController \< ActionController::Base  
before\_filter :authorize, :except =\> :login

```
def authorize
   unless session[:user]
      flash[:notice] = "Please log in"
      session[:jumpto] = request.parameters
      redirect_to :controller => "login", :action => "login"
   end
end

```

end

So, basically, redirect a user to the login screen if they haven’t  
already  
logged in. Pretty standard stuff.

But, if I want to setup a web service, how do I set session data from  
the  
client side through, say, an xmlrpc call using layered dispatching?  
I’ve tried  
messing around with the block form of the web\_service, and even tried  
setting  
up a LoginApi and LoginService, but no luck.

I’d like to be able to do this:

require ‘xmlprc/client’

rpc = XMLRPC::Client.new(‘localhost’, ‘[http://localhost/webservice/api](http://localhost/webservice/api)’,  
3000)  
rpc.call(‘login.login’, user, password) # Set session data here  
rpc.call(‘foo.findFooById’, 2) # Go on my merry way

I googled around a bit and couldn’t quite find the answer I was looking  
for.  
That, or I’m just not “getting it”.

What’s the best/proper way to handle this?

Thanks,

Dan

---

<div class="post-metadata">

**Author:** ![danielb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c57346/32.png) [@danielb](https://www.ruby-forum.com/u/danielb)\
**Post date:** [April 22, 2006, 2:52am UTC](https://www.ruby-forum.com/t/web-services-and-dealing-with-before-filter/58474/2 "2006-04-22T02:52:52Z")

</div>

Hi Daniel,  
In my web services I just ignore the authorization, but Im on an  
internal app. I think what an app I worked on before ( not rails ) did  
was something like:

def ws\_auth( user, pword)  
# auth the user

```
# create an entry in the db, and return some sort of unique key

```

end

def web\_service\_method( auth\_key , … )

# if the auth\_key doesnt exist in the db, ignore this request

end

then your client does:

auth\_key = rpc.call(‘login.login’, user, password) # Set session data  
here  
rpc.call(‘foo.findFooById’,auth\_key , 2) # Go on my merry way

not perfect, but might do for you

Paul

Daniel B. wrote:

> Hi all,
> 
> I’ve got a Rails app with a ApplicationController that looks like this:
> 
> class ApplicationController \< ActionController::Base  
> before\_filter :authorize, :except =\> :login
> 
> ```
> def authorize
> unless session[:user]
> flash[:notice] = "Please log in"
> session[:jumpto] = request.parameters
> redirect_to :controller => "login", :action => "login"
> end
> end
> 
> ```
> 
> end
> 
> So, basically, redirect a user to the login screen if they haven’t  
> already  
> logged in. Pretty standard stuff.
> 
> But, if I want to setup a web service, how do I set session data from  
> the  
> client side through, say, an xmlrpc call using layered dispatching?  
> I’ve tried  
> messing around with the block form of the web\_service, and even tried  
> setting  
> up a LoginApi and LoginService, but no luck.
> 
> I’d like to be able to do this:
> 
> require ‘xmlprc/client’
> 
> rpc = XMLRPC::Client.new(‘localhost’, ‘[http://localhost/webservice/api](http://localhost/webservice/api)’,  
> 3000)  
> rpc.call(‘login.login’, user, password) # Set session data here  
> rpc.call(‘foo.findFooById’, 2) # Go on my merry way
> 
> I googled around a bit and couldn’t quite find the answer I was looking  
> for.  
> That, or I’m just not “getting it”.
> 
> What’s the best/proper way to handle this?
> 
> Thanks,
> 
> Dan

---

<div class="post-metadata">

**Author:** ![danielb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c57346/32.png) [@danielb](https://www.ruby-forum.com/u/danielb)\
**Post date:** [April 22, 2006, 3:22am UTC](https://www.ruby-forum.com/t/web-services-and-dealing-with-before-filter/58474/3 "2006-04-22T03:22:55Z")

</div>

What I did was to include in the authorization in the web service. I  
have a method like User.authenticate?(user) which returns true or false.  
This is used by my authentication filter as u have done. Every time  
someone sends in a request they must include the username/password in  
the request, which is then used to check if he is valid or not.

For higher security you can either run it through https (haven’t tried  
this), encode it in base64, encrypt it using some private key algo, or  
use WSS4R.

This method is probably not high-performing, alternatively you can use a  
token mechanism to check if he is a valid user (instead of checking  
everytime, return a token) , but if your requests are low volume it  
should be ok.

Hope this helped.

Daniel B. wrote:

> ```
> session[:jumpto] = request.parameters
> 
> ```
> 
> dispatching? I’ve tried messing around with the block form of the  
> rpc.call(‘foo.findFooById’, 2) # Go on my merry way  
> Rails mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

–  
Sau S.

[http://blog.saush.com](http://blog.saush.com)  
[http://read.saush.com](http://read.saush.com)  
[http://jaccal.sourceforge.net](http://jaccal.sourceforge.net)