Signed requests

[jamesfzhang]

Do you support signed requests with a timed TTL?

[gonzalo-bulnes]

Hello @jamesfzhang,

I'm not sure to understand exactly what you want to do. It might be possible taking advantange of the Simple Token authentication hooks feature. Anyway, it sounds like JWT might interest you. (There are Ruby implementations, I haven't used any.)

[jamesfzhang]

Hi @gonzalo-bulnes,

I'm interested in something very similar to JWT. The authentication hooks feature would be really helpful. After authenticate_user! runs, I want to verify the request with JWT. Thanks for your help!

[gonzalo-bulnes]

Hi @jamesfzhang,

Sorry for the latency :P
It seems that could be done through similar logic to #300. The payload signature verification would really happen around token comparison. Does that make sense to you? (Maybe you've moved on at this point, have you found a satisfactory solution to get that behaviour?)