Rails API expiration for user auth token
<p>I build an Rest API with rails. And I want to implement an expiration for the token. How does it works ?
I don't to implement devise because I don't need that really.
I just want when I create an user he received an token a refresh token.
So it's not really oauth because there are not 3rd party using the api.</p>

<pre><code>This is my user model.
    require 'securerandom'
      class User
      field :auth_token, type: String
      field :name, type: String
      field :phone, type: String
      field :image, type: String

      #Generate URLS for different image sizes...
       def as_json(options)
        json = super
        self.image.styles.each do | format |
          json = json.merge({"image_"+format[0].to_s =&gt; self.image(format[0])})
        end
        json
      end

      private
        def set_auth_token
          return if auth_token.present?
          self.auth_token = generate_auth_token
        end

        def generate_auth_token
          SecureRandom.hex(90)  
        end

      end
</code></pre>

<p>So simple auth with a simple generated token works. But I think with an expiration token is more secure. Of course the connection is over SSL.</p>

<pre><code>class ApplicationController &lt; ActionController::API
  include ActionController::HttpAuthentication::Token::ControllerMethods

    def current_user
        @current_user = User.find(params[:user_id])
    end


protected

    def authenticate
      authenticate_token || authentication_request
    end


    def authenticate_token
      authenticate_or_request_with_http_token do |token, options|
      User.where(auth_token: token).first
      end
    end

    def authentication_request(controller, realm)
      controller.headers["WWW-Authenticate"] = %(Token realm="#{realm.gsub(/"/, "")}")
      controller.__send__ :render, :text =&gt; "HTTP Token: Access denied.\n", :status =&gt; :unauthorized
    end

    def request_http_token_authentication(realm = "Application")
      self.headers["WWW-Authenticate"] = %(Token realm="#{realm.gsub(/"/, "")}")
      render :json =&gt; {:error =&gt; "HTTP Token: Access denied."}, :status =&gt; :unauthorized
    end

end
</code></pre>