{"action":"created","issue":{"url":"https://api.github.com/repos/Joe-noh/railstutorial/issues/9","labels_url":"https://api.github.com/repos/Joe-noh/railstutorial/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/Joe-noh/railstutorial/issues/9/comments","events_url":"https://api.github.com/repos/Joe-noh/railstutorial/issues/9/events","html_url":"https://github.com/Joe-noh/railstutorial/pull/9","id":102709452,"number":9,"title":"[WIP] JWTを使って認証するぞ","user":{"login":"Joe-noh","id":2364702,"avatar_url":"https://avatars.githubusercontent.com/u/2364702?v=3","gravatar_id":"","url":"https://api.github.com/users/Joe-noh","html_url":"https://github.com/Joe-noh","followers_url":"https://api.github.com/users/Joe-noh/followers","following_url":"https://api.github.com/users/Joe-noh/following{/other_user}","gists_url":"https://api.github.com/users/Joe-noh/gists{/gist_id}","starred_url":"https://api.github.com/users/Joe-noh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Joe-noh/subscriptions","organizations_url":"https://api.github.com/users/Joe-noh/orgs","repos_url":"https://api.github.com/users/Joe-noh/repos","events_url":"https://api.github.com/users/Joe-noh/events{/privacy}","received_events_url":"https://api.github.com/users/Joe-noh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-24T05:25:28Z","updated_at":"2015-08-25T02:28:43Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Joe-noh/railstutorial/pulls/9","html_url":"https://github.com/Joe-noh/railstutorial/pull/9","diff_url":"https://github.com/Joe-noh/railstutorial/pull/9.diff","patch_url":"https://github.com/Joe-noh/railstutorial/pull/9.patch"},"body":"### 概要\r\n\r\nWeb版ではcookieを読んで`current_user`をセットしていましたが、API版ではログイン時にトークンを渡して、以後のリクエストにそれを付けてもらうようにします。\r\n\r\n`remember_token`を使おうという話をしていましたが、Web版でログアウトするとアプリ側もログアウトしてしまうので、却下となりました。\r\n\r\nなのでトークンには`user_id`を使い、モダンに[JWT](https://tools.ietf.org/html/rfc7519)を発行します。\r\nペイロードが`{user_id: 3}`ってことです。\r\n\r\n### 流れ\r\n\r\n1. clientがemail/passをPOST\r\n1. `user_id`からJWTを作る\r\n1. レスポンスボディとして`{auth_token: \"jwt_string\"}`が返る\r\n1. リクエストヘッダに`Authorization: \"Bearer jwt_string\"`を付けたリクエストをclientが送る\r\n1. serverはそれを見てOKなら`current_user`をセット。ダメなら401\r\n"},"comment":{"url":"https://api.github.com/repos/Joe-noh/railstutorial/issues/comments/134453873","html_url":"https://github.com/Joe-noh/railstutorial/pull/9#issuecomment-134453873","issue_url":"https://api.github.com/repos/Joe-noh/railstutorial/issues/9","id":134453873,"user":{"login":"Joe-noh","id":2364702,"avatar_url":"https://avatars.githubusercontent.com/u/2364702?v=3","gravatar_id":"","url":"https://api.github.com/users/Joe-noh","html_url":"https://github.com/Joe-noh","followers_url":"https://api.github.com/users/Joe-noh/followers","following_url":"https://api.github.com/users/Joe-noh/following{/other_user}","gists_url":"https://api.github.com/users/Joe-noh/gists{/gist_id}","starred_url":"https://api.github.com/users/Joe-noh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Joe-noh/subscriptions","organizations_url":"https://api.github.com/users/Joe-noh/orgs","repos_url":"https://api.github.com/users/Joe-noh/repos","events_url":"https://api.github.com/users/Joe-noh/events{/privacy}","received_events_url":"https://api.github.com/users/Joe-noh/received_events","type":"User","site_admin":false},"created_at":"2015-08-25T02:28:43Z","updated_at":"2015-08-25T02:28:43Z","body":"### ログイン\r\n\r\n```\r\n% curl -XPOST -d '{\"session\": {\"email\": \"example@railstutorial.org\", \"password\": \"foobar\"}}' -H \"Content-Type: application/json\" -i http://localhost:3000/api/login\r\nHTTP/1.1 201 Created\r\nX-Frame-Options: SAMEORIGIN\r\nX-Xss-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nContent-Type: application/json; charset=utf-8\r\nEtag: W/\"2296065b2808e4f4bb20b01ab2d435ee\"\r\nCache-Control: max-age=0, private, must-revalidate\r\nX-Request-Id: 41f59888-d15d-45a7-83b4-eb1d6e43a5d0\r\nX-Runtime: 0.106985\r\nServer: WEBrick/1.3.1 (Ruby/2.2.2/2015-04-13)\r\nDate: Tue, 25 Aug 2015 02:21:35 GMT\r\nContent-Length: 123\r\nConnection: Keep-Alive\r\n\r\n{\"auth_token\":\"Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxfQ.iZ-R705vf1Zx-qa-MnKvTAmZyBLM0lZWzwaux8r4yyI\"}\r\n```\r\n\r\n### 以後のリクエスト\r\n\r\n```\r\n% curl -XGET -H \"Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxfQ.iZ-R705vf1Zx-qa-MnKvTAmZyBLM0lZWzwaux8r4yyI\" -i http://localhost:3000/api/feed\r\nHTTP/1.1 200 OK\r\nX-Frame-Options: SAMEORIGIN\r\nX-Xss-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nContent-Type: application/json; charset=utf-8\r\nEtag: W/\"9dbb9569d9d4090785c08c7022783d6a\"\r\nCache-Control: max-age=0, private, must-revalidate\r\nX-Request-Id: 08246996-45a1-49a5-8197-0a702e92b9b1\r\nX-Runtime: 0.119622\r\nServer: WEBrick/1.3.1 (Ruby/2.2.2/2015-04-13)\r\nDate: Tue, 25 Aug 2015 02:27:27 GMT\r\nContent-Length: 47684\r\nConnection: Keep-Alive\r\n\r\n[{\"id\":301,\"content\":\"kan-yu!\",\"user_id\":1,\"created_at\":\"2015- ...\r\n```\r\n\r\nよさそう"}}