How to secure your RESTful API

# my_api/app/models/user.rb
 
class User < ActiveRecord::Base
 
  validates :email, presence: true, uniqueness: true
  validates :name, presence: true
 
end

$ rails g model Token token expires_at:datetime user:references
$ rails g model Article title body:text user:references

Rails.application.routes.draw do
  namespace :api, defaults: { format: "json" } do
    namespace :v1 do
      resources :users, only: [:create] # we only need the 'create' action to add new users
      resources :articles, except: [:new, :edit] # we won't need these actions since this is an API
    end
  end
end

# my_api/app/models/user.rb
 
class User < ActiveRecord::Base
 
  validates :email, presence: true, uniqueness: true
  validates :name, presence: true
 
  def self.with_token(data)
    User.where(email: data[:email]).first_or_create do |user|
      user.email = data[:email]
      user.name = data[:name]
    end
  end
 
end

class Token < ApplicationRecord
  belongs_to :user
  before_create :generate_token
 
  def valid?
    self.expires_at > DateTime.now
  end
 
  private
 
  def generate_token
    loop do
      self.token = SecureRandom.hex
      break unless Token.where(token: self.token).exists?
    end
    self.expires_at = 3.month.from_now
  end
end

# POST api/v1/users, params: { user: { email: 'giancarlos@devacademy.la', name: 'Giancarlos Isasi' } }
def create
  if params[:user]
    @user = User.with_token(params[:user]) # we pass the info our 'with_token' method will use to create the user
    @token = @user.tokens.create() # we create a new token for the user returned by 'with_token'
    render "api/v1/users/show" # this view will display the user's info along with their token
  else
    render json: { error: 'user params info is missing' } # only if we aren't sent the required info
  end
end

# views/api/v1/users/show.json.jbuilder
 
json.(@token, :token)
json.(@user, :id, :name, :email)

{
  "token": "8b7794a62dd440db597b3566f95dc6fb",
  "id": 1,
  "name": "Giancarlos Isasi",
  "email": "giancarlos@devacademy.la"
}

post 'api/v1/articles', params: { article: { title: 'my first API', body: 'my first api with Ruby on Rails!!' }, token: '8b7794a62dd440db597b3566f95dc6fb' }

class ApplicationController < ActionController::Base
  # protect_from_forgery with: :null_session
 
  protected
 
  def authenticate # we'll use this method in our Articles controller to know which user wants to create an article.
                   # It also lets us check whether the user owns the article they want to update or delete
    token_of_params = params[:token] # we grab the token sent in the request
    token = Token.find_by_token(token_of_params) # we check that the token exists in the database
 
    if !token.nil?
      if token.valid? # we check the token is valid using the instance method we defined in our Token model
        @current_user = token.user # we get the current user from the token that was sent
      else
        render json: { error: 'token invalid :(' } # error message if the token has expired
      end
    else
      render json: { error: 'token is missing :|' } # error message if the token wasn't sent or doesn't exist in the database
    end
  end
 
end

class Api::V1::ArticlesController < ApplicationController
  before_action :authenticate, only: [:create, :update, :destroy] # using the method from our ApplicationController we verify the token is valid and authenticate the user (assigned to our @current_user variable)
  before_action :set_article, only: [:show, :update, :destroy] # the typical method to find the article, no explanation needed
 
  def index
    @articles = Article.all
  end
 
  def show
  end
 
  def create
 
    @article = @current_user.article.new(quiz_params) # we've already identified the user, so we create the article for them
    if @article.save
      render template: 'api/v1/articles/show' # we render our show view to display the created article's data
    else
      render json: { error: @article.errors }, status: :unprocessable_entity # if validations fail, show the errors — though it should pass, since we have no validations :|
    end
 
  end
 
  def update
    if @current_user == @article.user # we use current_user to verify the user is indeed the one who created the article
      @article.update(quiz_params) # once we've validated the user owns the article, we perform the update
      render 'api/v1/quizzes/show' # we display the updated data
    else
       render json: { error: 'you dont have permission' }, status: :unauthorized # if the user isn't the one who created the article, show the errors
    end
  end
 
  private
 
  def set_article
    @article = Article.find(params[:id]) # we identify the article to update or delete
  end
 
  def quiz_params
    params.require(:article).permit(:title, :body) # the typical strong params, not much to explain
  end
end