Example AuthenticationToken implementation using ActiveSupport::MessageEncryptor

authentication_token.rb

class AuthenticationToken
  # Encode a hash
  def self.encode(payload, ttl: 14.days.to_i)
    keygen = ActiveSupport::KeyGenerator.new(Rails.application.secrets.token_secret)
    key    = keygen.generate_key(Rails.application.secrets.token_salt, 32)
    crypt  = ActiveSupport::MessageEncryptor.new(key)
    payload[:expires] = ttl.seconds.from_now.to_i

    crypt.encrypt_and_sign(JSON.dump(payload.deep_stringify_keys))
  end

  # Decode a token and return the payload inside
  def self.decode(token)
    keygen = ActiveSupport::KeyGenerator.new(Rails.application.secrets.token_secret)
    key    = keygen.generate_key(Rails.application.secrets.token_salt, 32)
    crypt  = ActiveSupport::MessageEncryptor.new(key)

    decoded = crypt.decrypt_and_verify(token)
    payload = JSON.parse(decoded)
    
    if payload["expires"] < Time.now.to_i
      raise TokenExpiredError.new("The access token has expired")
    end

    HashWithIndifferentAccess.new(payload)
  end

  class TokenExpiredError < StandardError; end
end