Multiple Devise Scope Support
marclennox opened this issue · comments
I have multiple Devise scopes that both use devise-jwt for authentication. Because warden uses the same header for the auth token (warden-jwt_auth.token), it is not possible to be logged in with both scopes simultaneously. Is there a suggested way around this, such that the warden header is unique for each scope?
@marclennox it should be possible to log in using either scope without issues. The token is in the request information, and its payload contains the scope that is trying to authenticate, so two different requests can authenticate two users from different scopes.
@waiting-for-dev Thanks for this. As I dig deeper into this I'm getting closer to understanding what's going on, but still not there. I'll try and expand a bit on what I'm doing and what I've seen.
For context, I'm using cookies to handle the jwt authentication. As an after_action on the sessions controller, I'm setting a cookie to the value stored in request.headers['warden-jwt_auth.token']. I have 2 separate cookies, one for each of the 2 scopes I'm handling.
Each scope uses its own sessions controller, so each sets its own specific cookie post login.
I then have a custom warden strategy that reads the cookie and decodes the user.
Is request.headers['warden-jwt_auth.token'] the proper place to pull the newly created JWT?
Hey @marclennox, sorry for the late response.
For context, I'm using cookies to handle the jwt authentication.
If you're using cookies, I'd say you don't need to use devise-jwt. Unless I'm missing something, you could rely on plain devise.
Is request.headers['warden-jwt_auth.token'] the proper place to pull the newly created JWT?
The token is set in env['warden-jwt_auth.token'] here
I support both header-based and cookie-based auth, but perhaps I could get away just with warden-jwt? Thanks for the heads up on where the env gets set.
Sure, you can do anything with only warden-jwt_auth. You have to assess whether the integration it provides with the Rails model layer helps you. If you're going to implement a super-specific workflow, it's an option to get rid of it.
I'm going to close it, but feel free to add more comments if needed