I am trying to fix an authorization/authentication strategy for a Rails app (5.2). I am migrating the front-end w/o an API. I have however connected the backend through a GraphQL flow. I am planning to keep the current web app as a monolithic application where the frontend is React.

I am looking for a strategy/architecture to address this objective. It may extends to routing with Rails or with React router or a mix of both.

My current setup is:

Authentication => proving user with a mean to access such as a login + password through devise Authorization => setting permissions through Cancan and rolify

I will be happy to migrate from Devise, if it is the limiting part.


  1. the user can login and logout from the React frontend.
  2. the user can sign-in from the React frontend.
  3. a registered user can access data from a GraphQL enabled local client.

My plan is the following:

  • Make Devise work with JSON requests
  • Configure Rails controllers appropriately to work with tokens only
  • Build an authentication controller that "accept" the user
  • Route the accepted users to the React router for most of the routes

Is that a good implementation to consider ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.