app/controllers/application_controller.rb
def override_session_if_token
    @token = params["token"] || params["auth_token"] || params["access_token"]
    if @token
      #current-user's token matches params[:token] then he is signed-in nothing to do here
      if current_user
        if (current_user.authentication_token == @token)
          return true
        else
          #params[:token] doesn't match that of current_user
          #logout current_user and sign-in that user who owns token
          sign_out(current_user)
        end
      end

      user = User.find_by_authentication_token(@token)
      unless user
        render_401("Invalid authentication token") and return false
        return false
      end
      Rails.logger.info("ApplicationController: New login #{user.name}")
      sign_in(user)
    elsif current_user
      @token = current_user.authentication_token
    elsif (not current_user)
      render_401
      return false
    end
    return true
  end
# Prevent CSRF attacks by raising an exception.
# For APIs, you may want to use :null_session instead.
Prevent CSRF attacks by raising an exception.
For APIs, you may want to use :null_session instead.
Prevent CSRF attacks by raising an exception . For APIs you may want to use : null_session instead .
def override_session_if_token
    @token = params["token"] || params["auth_token"] || params["access_token"]
    if @token
      if current_user
        if (current_user.authentication_token == @token)
          return true
        else
          sign_out(current_user)
        end
      end
      user = User.find_by_authentication_token(@token)
      unless user
        render_401("Invalid authentication token") and return false
        return false
      end
      Rails.logger.info("ApplicationController: New login #{user.name}")
      sign_in(user)
    elsif current_user
      @token = current_user.authentication_token
    elsif (not current_user)
      render_401
      return false
    end
    return true
  end
def override_session_if_token @token = params [ "token" ] || params [ "auth_token" ] || params [ "access_token" ] if @token if current_user if ( current_user . authentication_token == @token ) return true else sign_out ( current_user ) end end user = User . find_by_authentication_token ( @token ) unless user render_401 ( "Invalid authentication token" ) and return false return false end Rails . logger . info ( "ApplicationController: New login #{user.name}" ) sign_in ( user ) elsif current_user @token = current_user . authentication_token elsif ( not current_user ) render_401 return false end return true end
Prevent CSRF attacks by raising an exception.
Prevent CSRF attacks by raising an exception .
#current-user's token matches params[:token] then he is signed-in nothing to do here #params[:token] doesn't match that of current_user #logout current_user and sign-in that user who owns token