Allowing http token auth to set the token_authentication_key if missing from params

[robhurring]

Allows the user to configure devise to allow token auth headers to set the missing "token_authentication_key" param with a new setting in the config "allow_authorization_to_set_auth_token". When set to true it will parse out the token from the request headers and update the param for "token_authentication_key".

[josevalim]

Thanks @robhurring. However, you explained how the feature is implemented, you haven't explained why you need it thought. Could please tell us why? Why the current token mechanism is not enough?

[robhurring]

There is really nothing in particular lacking with the current basic auth flow for authenticating, but for an API we felt using token auth was semantically better. The reasoning behind this was more for allowing the API client to pass in options with the token which the app can use. I didn't include that piece of the code in this PR since I wasn't exactly sure how to make it feel natural in devise.

In our current implementation we're passing in a request signature with the token, the signature (and any other metadata) is then bubbled up to the app in env['devise.token_options'] and handled from there. It can also be used to handle token expiration or other use cases. If this sounds like it could be useful for devise I can commit those change as well.

[josevalim]

Can we call this configuration option something like allow_token_authenticatable_via_headers or something like it?

[robhurring]

I like that much better -- fixed!

[josevalim]

In our current implementation we're passing in a request signature with the token, the signature (and any other metadata) is then bubbled up to the app in env['devise.token_options'] and handled from there.

This approach is also fine. We could include the options in env['devise.token_options'] as well. Could you please update your pull request?

Thanks a lot!

[josevalim]

Thanks a lot @robhurring! Sorry for the delay.

Maybe instead of merging into the params hash, we could add a valid_token_auth? check as well, similar to what we do with http auth:

https://github.com/robhurring/devise/blob/547439d94c32a63a11260f96e3713b88c6b6ac68/lib/devise/strategies/authenticatable.rb#L70

[robhurring]

@josevalim no worries, its been a pretty busy month for me as well. I made those changes and mimicked the http auth flow pretty close. Give it a glance when you have a minute and let me know if theres any other changes that need to be made.

[josevalim]

Perfect pull request! I have merged it, sorry for the delay!