0

I am implementing the backend of an iOS mobile application with a Ruby on Rails app. I am currently doing user creation and authentication and have ran into some issues. I have an API that allows users to create a user account via RESTful routes. I am trying to now set up some sort of process that allows the user to log in to the newly created account. I think the login process should go something like this: when the user logs in the api creates some sort of mobile session and when they log out the client terminates the session from their end. First off I was wondering if this is the correct way to implement such a system?

Secondly I would like to get some ideas on how this system should be set up. My first thought would be to create new database model named xsession or msession that holds all of the device specific variables such device tokens and user information that's relevant to the session. The session would be created after the password is verified against the one already stored in the user database model. The session would be tied to the users ID and upon log out would be removed from the database. This would create a table in which the rows would represent all active mobile sessions. Is this the best way to do this? Let me know what everyone thinks, this is my first time implementing something like this and I'm excited to see if I'm on the right track.

ScottOBot
  • 839
  • 3
  • 16
  • 37

2 Answers2

1

Use an authentication token: http://matteomelani.wordpress.com/2011/10/17/authentication-for-mobile-devices/

You can put the auth_token in the users table or have a separate table for instance called devices where you store the device information and auth token.

Matteo Melani
  • 2,706
  • 2
  • 24
  • 30
0

The iOS networking library manages session cookies just like a browser would, which means it will store the session cookie it receives from your Rails server and send it back in each following request.

This means you can still use standard Rails sessions to authenticate users that are using the mobile client.

Also, know that cookies without an expiration date are considered 'session only' and will get cleared when you restart the app (See: Persisting Cookies In An iOS Application?).

Community
  • 1
  • 1
justinokamoto
  • 301
  • 2
  • 8