# Webservices Xml-Rpc and authentication **URL:** \ **Category:** Rails\ **Created:** [July 14, 2006, 1:16am UTC](https://www.ruby-forum.com/t/webservices-xml-rpc-and-authentication/98349 "2006-07-14T01:16:57Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Md\_Mooktakim\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@Md\_Mooktakim\_A](https://www.ruby-forum.com/u/Md_Mooktakim_A)\ **Post date:** [July 14, 2006, 1:16am UTC](https://www.ruby-forum.com/t/webservices-xml-rpc-and-authentication/98349/1 "2006-07-14T01:16:57Z")
Hello, I want to build an application where i have client and server. I need to exacute commands with XM-RPC. I can get all this working, following the howto’s in wiki and main website. But the problem is they are all unsecure. I can’t seem to find any web service examples where they use authentication, or ssl. Just wondering if anyone know how i go about doing this. At the moment all i can think of is sending username and password with every method. These are the howto’s i’m following: [http://wiki.rubyonrails.com/rails/pages/HowtoWriteAXmlRpcService](http://wiki.rubyonrails.com/rails/pages/HowtoWriteAXmlRpcService) [http://manuals.rubyonrails.com/read/book/10](http://manuals.rubyonrails.com/read/book/10) Thanks for any help – Website: [http://www.mooktakim.com](http://www.mooktakim.com) email: removed\_email\_address@domain.invalid ---
**Author:** ![Md\_Mooktakim\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@Md\_Mooktakim\_A](https://www.ruby-forum.com/u/Md_Mooktakim_A)\ **Post date:** [July 14, 2006, 8:21pm UTC](https://www.ruby-forum.com/t/webservices-xml-rpc-and-authentication/98349/2 "2006-07-14T20:21:14Z")
“Md Mooktakim A.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes: > This book might help, I myself haven’t tried it yet. > **[Web Services on Rails](https://www.oreilly.com/library/view/web-services-on/0596527969/)** > > This PDF will show you how your small business or enterprise can publish its APIs (application programming interface) to a developer community just like the behemoths of the Internet--Google, Yahoo!, … - Selection from Web Services on Rails \[Book\] In case, you purchase it, do let us know how did you find it. ## HTH. Surendra S. [http://ssinghi.kreeti.com](http://ssinghi.kreeti.com), [http://www.kreeti.com](http://www.kreeti.com) Read my blog at: [http://cuttingtheredtape.blogspot.com/](http://cuttingtheredtape.blogspot.com/) ,---- | “O thou my friend! The prosperity of Crime is like unto the lightning, | whose traitorous brilliancies embellish the atmosphere but for an | instant, in order to hurl into death’s very depths the luckless one | they have dazzled.” – Marquis de Sade `---- ---
**Author:** ![Md\_Mooktakim\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@Md\_Mooktakim\_A](https://www.ruby-forum.com/u/Md_Mooktakim_A)\ **Post date:** [July 14, 2006, 8:40pm UTC](https://www.ruby-forum.com/t/webservices-xml-rpc-and-authentication/98349/3 "2006-07-14T20:40:55Z")
Surendra S. wrote: > “Md Mooktakim A.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes: > > This book might help, I myself haven’t tried it yet. > [Web Services on Rails [Book]](http://www.oreilly.com/catalog/websor/) I own that PDF “Book”. It doesn’t mention authentication in it. I can recommend the book though, its got some good stuff - you just won’t find any kind of login type stuff. ---
**Author:** ![Md\_Mooktakim\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@Md\_Mooktakim\_A](https://www.ruby-forum.com/u/Md_Mooktakim_A)\ **Post date:** [July 14, 2006, 10:17pm UTC](https://www.ruby-forum.com/t/webservices-xml-rpc-and-authentication/98349/4 "2006-07-14T22:17:50Z")
> and so on. > Can anyone else think of a better way? I recently did an XML-RPC service with authentication and just used standard HTTP auth stuff. It’s worked just fine so far. That said, I wouldn’t do it that way again. There’s no good way to get at the login information (yes, you can get it, but not in the models). I think I’d go with something you have above and have them pass it in as the first argument to every method. That way you have it easily available so you can do things with it (throttle certain users, delays, etc.) -philip ---
**Author:** ![Md\_Mooktakim\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@Md\_Mooktakim\_A](https://www.ruby-forum.com/u/Md_Mooktakim_A)\ **Post date:** [July 14, 2006, 11:01pm UTC](https://www.ruby-forum.com/t/webservices-xml-rpc-and-authentication/98349/5 "2006-07-14T23:01:20Z")
Where would be the best place to store to current token? Should it be session? I haven’t worked this about yet 🙂 Still thinking out loud. On Fri, July 14, 2006 9:19 pm, Philip H. wrote: > > > > you can do things with it (throttle certain users, delays, etc.) > > > > > “Md Mooktakim A.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes: > > > > recommend the book though, its got some good stuff - you just won’t find any kind of > > > > removed\_email\_address@domain.invalid > > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) – Website: [http://www.mooktakim.com](http://www.mooktakim.com) email: removed\_email\_address@domain.invalid ---
**Author:** ![Md\_Mooktakim\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@Md\_Mooktakim\_A](https://www.ruby-forum.com/u/Md_Mooktakim_A)\ **Post date:** [July 15, 2006, 5:56am UTC](https://www.ruby-forum.com/t/webservices-xml-rpc-and-authentication/98349/6 "2006-07-15T05:56:31Z")
On Fri, Jul 14, 2006 at 12:14:11AM +0100, Md Mooktakim A. wrote: > I want to build an application where i have client and server. I need to exacute > commands with XM-RPC. I can get all this working, following the howto’s in wiki and main > website. > But the problem is they are all unsecure. I can’t seem to find any web service examples > where they use authentication, or ssl. Adding SSL support to the webrick in rails is pretty simple, and adding verification of client-side certificates is trivial from there. Presenting the cert from the client end is pretty simple, too. Client-side certs aren’t that great if you’re trying to let random people in, but most authenticated web services are there for the use of a limited set of people, so the certificate management burden isn’t too bad. If you’re doing something where you’ve got people (eg) doing their own accounts, then you’ll want a login method that returns a session “cookie”, and then that gets passed as the first parameter to every other method, so the user can prove that they’re logged in. - Matt – How about “suspender snapping three martini lunching mahogany tabled conference room equipped with overhead projector dwelling golden parachute flying bill gates specifying buzzword spewing computerworld and datamation reading trend bandwagoneering meeting going morons”. – Tom O’Toole ---
**Author:** ![Md\_Mooktakim\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@Md\_Mooktakim\_A](https://www.ruby-forum.com/u/Md_Mooktakim_A)\ **Post date:** [July 14, 2006, 9:56pm UTC](https://www.ruby-forum.com/t/webservices-xml-rpc-and-authentication/98349/7 "2006-07-14T21:56:31Z")
hhmm, Its VERY strange. I haven’t done any xml-rpc or SOAP stuff before. But i would think authentication would be the first thing people do. Only way i can think of now is the have a login menthod. The after that use a random token for the rest of the methods. Maybe even change the token every time randomly. So here it is: login(username, password) → returns [true, random\_token] get\_user\_data(token) → returns [[some\_data], new\_random\_token] and so on. Can anyone else think of a better way? On Fri, July 14, 2006 7:40 pm, Bob Y. wrote: > I own that PDF “Book”. It doesn’t mention authentication in it. I can – Website: [http://www.mooktakim.com](http://www.mooktakim.com) email: removed\_email\_address@domain.invalid