I am trying to fix an authorization/authentication strategy for a Rails app (5.2). I am migrating the front-end w/o an API. I have however connected the backend through a GraphQL flow. I am planning to keep the current web app as a monolithic application where the frontend is React.
I am looking for a strategy/architecture to address this objective. It may extends to routing with Rails or with React router or a mix of both.
My current setup is:
Authentication => proving user with a mean to access such as a login + password through devise Authorization => setting permissions through Cancan and rolify
I will be happy to migrate from Devise, if it is the limiting part.
- the user can login and logout from the React frontend.
- the user can sign-in from the React frontend.
- a registered user can access data from a GraphQL enabled local client.
My plan is the following:
- Make Devise work with JSON requests
- Configure Rails controllers appropriately to work with tokens only
- Build an authentication controller that "accept" the user
- Route the accepted users to the React router for most of the routes
Is that a good implementation to consider ?