0

I am trying to replace an old PHP server with a Rails server. There are several clients that I do not control, that authenticate by providing a username and password in the url:

https://user:password@example.com/update

How can I extract the user and password from a url in a Rails 6 application?

When I look at the url or path via the request object the user and password are stripped. The request routes correctly, I just cannot extract the credentials in order to authenticate.

Additional detail added

I first started going down the basic auth path (even though I don't fully understand that term). I looked at some questions including this basic auth Rails question. Maybe I am missing something, but the sample code does not work. If I do the following:

curl "http://example.com/update?foo=bar" -u "user:pass"

I am able to access the user and password for basic auth. However

curl "http://user:pass@example.com/update?foo=bar"

Wait - that actually works! I was testing the requests from Safari and the basic auth attributes were ignored and not available in my controller, but when I run the request from curl it works. Crazy.

I am going to leave this question up in case someone else encounters this specific scenario. Maybe they will see this and solve the issue.

Scott
  • 674
  • 1
  • 7
  • 15
  • There is nothing in the params object in the controller action? – dbugger Nov 23 '21 at 11:48
  • @dbugger - no, nothing in the params – Scott Nov 23 '21 at 13:11
  • Please add your controller and route file to the question. – dbugger Nov 23 '21 at 13:14
  • 1
    From the url provided, it looks to be like basic auth. If that is the case then you can check this: [answer](https://stackoverflow.com/questions/14374580/doing-a-http-basic-authentication-in-rails) – Aleksis Zalitis Nov 23 '21 at 13:38
  • If you're using Devise it has built in support for HTTP basic auth. You just need to enable it. https://github.com/heartcombo/devise/wiki/How-To:-Use-HTTP-Basic-Authentication – max Nov 23 '21 at 14:26
  • 1
    Safari might not allow HTTP Basic auth when you're using HTTP and not HTTPS. Curl is more of a pointy tool. https://developer.apple.com/forums/thread/96293 – max Nov 23 '21 at 18:21
  • you need a route defined in config/routes.rb that can match the url, with variable placeholders in place of user and password. This is a highly unusual login format! – Les Nightingill Nov 24 '21 at 19:14

0 Answers0