# Web services and security

**URL:** <https://www.ruby-forum.com/t/web-services-and-security/57511>\
**Category:** Rails\
**Created:** [April 11, 2006, 5:14pm UTC](https://www.ruby-forum.com/t/web-services-and-security/57511 "2006-04-11T17:14:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![danielb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c57346/32.png) [@danielb](https://www.ruby-forum.com/u/danielb)\
**Post date:** [April 11, 2006, 5:14pm UTC](https://www.ruby-forum.com/t/web-services-and-security/57511/1 "2006-04-11T17:14:08Z")

</div>

Hi all,

How do folks generally secure their Rails web services? A password in a  
config  
file? A ‘webservice’ user in a ‘Users’ table with its own password?  
LDAP  
authentication for every method? Only authenticate on the “important”  
methods?  
Something else I’m not thinking of?

I’d like to be secure, yet practical, for the sake of current and future  
developers.

What approach do Rails folks generally take?

Thanks,

Dan

---

<div class="post-metadata">

**Author:** ![danielb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c57346/32.png) [@danielb](https://www.ruby-forum.com/u/danielb)\
**Post date:** [April 11, 2006, 5:24pm UTC](https://www.ruby-forum.com/t/web-services-and-security/57511/2 "2006-04-11T17:24:21Z")

</div>

Daniel B. wrote:

> Hi all,
> 
> How do folks generally secure their Rails web services? A password in a  
> config  
> file? A ‘webservice’ user in a ‘Users’ table with its own password?  
> LDAP  
> authentication for every method? Only authenticate on the “important”  
> methods?  
> Something else I’m not thinking of?
> 
> I’d like to be secure, yet practical, for the sake of current and future  
> developers.
> 
> What approach do Rails folks generally take?
> 
> Thanks,
> 
> Dan

I would be interested in this as well. In our case, only pre-authorized  
users can access our service, so they must transmit a pre-determined  
identified with the request. If the id does not match a known id (in our  
database) the call is rejected (using before\_invocation)

Keith

---

<div class="post-metadata">

**Author:** ![danielb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c57346/32.png) [@danielb](https://www.ruby-forum.com/u/danielb)\
**Post date:** [April 11, 2006, 5:59pm UTC](https://www.ruby-forum.com/t/web-services-and-security/57511/3 "2006-04-11T17:59:39Z")

</div>

On 4/11/06, Daniel B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> What approach do Rails folks generally take?  
> You can utilize https protocol and pass user name and password with  
> every method. Or you can try to use wss4r. It depends on whichever  
> solution best fits your needs.

## – Kent

> **[DATANOISE.COM](https://www.datanoise.com/)**
>
> DATANOISE.COM - Contact us for any business inquiries

---

<div class="post-metadata">

**Author:** ![danielb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c57346/32.png) [@danielb](https://www.ruby-forum.com/u/danielb)\
**Post date:** [April 11, 2006, 6:02pm UTC](https://www.ruby-forum.com/t/web-services-and-security/57511/4 "2006-04-11T18:02:42Z")

</div>

I use a simple method – I send up the username/password and use the  
same authentication as the web app, every time. It’s not terribly  
secured though, but my app is not a highly secured anyway. Just to  
prevent a user to accidentally adding or erasing another user’s data.

I’m looking at WSS4R, looks promising just gotten it to work today.

Keith L. wrote:

> > Something else I’m not thinking of?
> 
> I would be interested in this as well. In our case, only pre-authorized  
> users can access our service, so they must transmit a pre-determined  
> identified with the request. If the id does not match a known id (in our  
> database) the call is rejected (using before\_invocation)
> 
> Keith

–  
Sau S.

[http://blog.saush.com](http://blog.saush.com)  
[http://read.saush.com](http://read.saush.com)  
[http://jaccal.sourceforge.net](http://jaccal.sourceforge.net)