Sample JWT Authentication

jwt_authentication_1.rb

class ApiController < ActionController::Base
  attr_reader :current_user
  before_action :set_current_user_from_jwt_token

  def set_current_user_from_jwt_token
    # Step 1: decode the JWT and get the user ID without checking
    # the signature. Note JWT tokens are *not* encrypted, but signed.
    payload = JWT.decode(request.authorization, nil, false)

    # Step 2: See if the user exists in the database
    @current_user = User.find(payload['user_id'])
   	
    # Step 3: Actually check to see if the JWT is signed correctly.
    # Will raise an JWT::DecodeError if the signature is not valid.
    JWT.decode(request.authorization, current_user.api_secret)
    
    # Step 4: Check the "iat" and "exp" times to make sure this
    # token was generated within this two second timeframe.
    # Prevents replaying the same access token.
    now = Time.now.to_i
    if payload['iat'] > now || payload['exp'] < now
      # Render some error indicating that the token has expired, 
      # and render a 401
    end
  rescue JWT::DecodeError
    # Display some error message and render a 401
  end
end