0

I have an iOS app that is using the Facebook SDK to authenticate. I am then able to use omniauth, devise, and omniauth-facebook-access-token (via AFNetworking) to create a user on the server for that facebook account.

Now I need my iOS app's user to be able to "have a session" on the RoR server - I could do that by passing some information in the headers or URL for each request to be authenticated or I could use a cookie. When the app makes API requests (JSON usually), I need those requests to be in the context of the user who has been authenticated.

What is the best practice for having an authenticated RoR user on an iOS app in this situation?

Some options that come to mind:

  • Maintain a cookie on the client
  • Send a piece of information for each API request in a header or somewhere else (access_token? user_id?)

My concern is that I want to be able to add additional oauth2 authentication providers without redoing this code.

Eric
  • 5,815
  • 3
  • 25
  • 34

1 Answers1

0

You need a token to authenticate the user, you should also keep sending the csrf-token in order to keep your app secure. Take a look at this question, and see how the csrf is handeled in its answer.

Community
  • 1
  • 1
mohameddiaa27
  • 3,587
  • 1
  • 16
  • 23