Regístrate para obtener una{" "}
cuenta de Auth0
{" "}
o{" "}
console.log("log in")}>
inicia sesión
{" "}
en tu cuenta existente para integrarte directamente con tu propio tenant.
;
};
export const sections = [{
id: "define-permissions",
title: "Definir permisos"
}, {
id: "install-dependencies",
title: "Instalar las dependencias"
}, {
id: "create-an-auth0client-class",
title: "Crear la clase Auth0Client"
}, {
id: "define-a-secured-concern",
title: "Definir el concern Secured"
}, {
id: "include-the-secure-concern-in-your-applicationcontroller",
title: "Incluir el concern Secure en ApplicationController"
}, {
id: "create-the-public-endpoint",
title: "Crear el endpoint público"
}, {
id: "create-the-private-endpoints",
title: "Crear los endpoints privados"
}];
Este tutorial realiza la validación del token de acceso mediante la gema [jwt](https://github.com/jwt/ruby-jwt) dentro de una clase `Auth0Client` personalizada. Se utiliza un Concern llamado
`Secured` para autorizar los endpoints que requieren autenticación mediante un token de acceso entrante.
Si aún no has creado una API en tu Auth0 Dashboard, usa el selector interactivo para crear una nueva API de Auth0
o selecciona una API existente para tu proyecto.
Para configurar su primera API a través del Auth0 Dashboard, consulte [nuestra guía de introducción](https://auth0.com/docs/get-started/auth0-overview/set-up-apis).
Cada API de Auth0 utiliza el identificador de API, que tu aplicación necesita para validar el token de acceso.
**¿Eres nuevo en Auth0?** Aprende [cómo funciona Auth0](https://auth0.com/docs/overview)
y lee sobre [cómo implementar la autenticación
y autorización de API](https://auth0.com/docs/api-auth) con el marco OAuth 2.0.
Los permisos le permiten definir cómo se puede acceder a los recursos en nombre del usuario con un token de acceso determinado. Por
ejemplo, puede conceder acceso de lectura al recurso `messages` si los usuarios tienen el nivel de acceso de gerente,
y acceso de escritura a ese recurso si tienen el nivel de acceso de administrador.
Puede definir los permisos permitidos en la vista **Permissions** de la sección [APIs](https://manage.auth0.com/#/apis) de Auth0 Dashboard.
Este ejemplo usa el scope `read:messages`.
Instala la \*\*gem jwt \*\*.
```bash lines theme={null}
gem 'jwt'
bundle install
```
Cree una clase llamada `Auth0Client`. Esta clase decodifica y verifica el token de acceso entrante obtenido
del encabezado `Authorization` de la solicitud.
La clase `Auth0Client` obtiene la clave pública de su inquilino de Auth0 y luego la usa para verificar la
firma del token de acceso. La estructura `Token` define un método `validate_permissions` para
buscar un `scope` específico en un token de acceso al proporcionar un array de alcances requeridos y comprobar si
están presentes en la carga útil del token.
Cree un Concern llamado `Secured` que busque el token de acceso en el encabezado `Authorization`
de una solicitud recibida.
Si el token está presente, `Auth0Client.validate_token` usará la gema `jwt` para verificar
la firma del token y validar sus claims.
Además de verificar que el token de acceso sea válido, el Concern también incluye un mecanismo para confirmar que el
token tiene el **scope** suficiente para acceder a los recursos solicitados. En este ejemplo, definimos un
método `validate_permissions` que recibe un bloque y comprueba los permisos llamando al
método `Token.validate_permissions` de la clase `Auth0Client`.
Para la ruta `/private-scoped`, los alcances definidos se cruzarán con los alcances incluidos en la
carga útil para determinar si contiene uno o más elementos del otro arreglo.
Al agregar el concern `Secure` al controlador de tu aplicación, solo tendrás que usar un
filtro `before_action` en el controlador que requiera autorización.
Cree un controlador para manejar el endpoint público `/api/public`.
El endpoint `/public` no requiere autorización, por lo que no hace falta `before_action`.
Crea un controlador para manejar los endpoints privados: `/api/private` y
`/api/private-scoped`.
`/api/private` está disponible para solicitudes autenticadas que contengan un token de acceso sin
alcances adicionales.
`/api/private-scoped` está disponible para solicitudes autenticadas que contengan un token de acceso con el scope
`read:messages` concedido
Los endpoints protegidos necesitan llamar al método `authorize` del concern `Secured`. Para ello, se usa `before_action :authorize`, lo que garantiza que el método `Secured.authorize` se llame antes de cada acción en el `PrivateController`.
### Realizar una llamada a tu API
Para realizar llamadas a tu API, necesitas un Token de acceso. Puedes obtener un Token de acceso para pruebas desde la vista
**Test** en la [configuración de tu
API](https://manage.auth0.com/#/apis).
Proporciona el Token de acceso como encabezado `Authorization` en tus solicitudes.
```bash cURL lines theme={null}
curl --request get \
--url 'http:///%7ByourDomain%7D/api_path' \
--header 'authorization: Bearer YOUR_ACCESS_TOKEN_HERE'
```
```csharp C# lines theme={null}
var client = new RestClient("http:///%7ByourDomain%7D/api_path");
var request = new RestRequest(Method.GET);
request.AddHeader("authorization", "Bearer YOUR_ACCESS_TOKEN_HERE");
IRestResponse response = client.Execute(request);
```
```go Go lines theme={null}
package main
import (
"fmt"
"net/http"
"io/ioutil"
)
func main() {
url := "http:///%7ByourDomain%7D/api_path"
req, _ := http.NewRequest("get", url, nil)
req.Header.Add("authorization", "Bearer YOUR_ACCESS_TOKEN_HERE")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := ioutil.ReadAll(res.Body)
fmt.Println(res)
fmt.Println(string(body))
}
```
```java Java lines theme={null}
HttpResponse response = Unirest.get("http:///%7ByourDomain%7D/api_path")
.header("authorization", "Bearer YOUR_ACCESS_TOKEN_HERE")
.asString();
```
```javascript Node.JS lines theme={null}
var axios = require("axios").default;
var options = {
method: 'get',
url: 'http:///%7ByourDomain%7D/api_path',
headers: {authorization: 'Bearer YOUR_ACCESS_TOKEN_HERE'}
};
axios.request(options).then(function (response) {
console.log(response.data);
}).catch(function (error) {
console.error(error);
});
```
```objc Obj-C lines theme={null}
#import
NSDictionary *headers = @{ @"authorization": @"Bearer YOUR_ACCESS_TOKEN_HERE" };
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"http:///%7ByourDomain%7D/api_path"]
cachePolicy:NSURLRequestUseProtocolCachePolicy
timeoutInterval:10.0];
[request setHTTPMethod:@"get"];
[request setAllHTTPHeaderFields:headers];
NSURLSession *session = [NSURLSession sharedSession];
NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request
completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
if (error) {
NSLog(@"%@", error);
} else {
NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response;
NSLog(@"%@", httpResponse);
}
}];
[dataTask resume];
```
```php PHP lines theme={null}
#import
NSDictionary *headers = @{ @"authorization": @"Bearer YOUR_ACCESS_TOKEN_HERE" };
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"http:///%7ByourDomain%7D/api_path"]
cachePolicy:NSURLRequestUseProtocolCachePolicy
timeoutInterval:10.0];
[request setHTTPMethod:@"get"];
[request setAllHTTPHeaderFields:headers];
NSURLSession *session = [NSURLSession sharedSession];
NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request
completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
if (error) {
NSLog(@"%@", error);
} else {
NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response;
NSLog(@"%@", httpResponse);
}
}];
[dataTask resume];
```
```python Python lines theme={null}
import http.client
conn = http.client.HTTPConnection("")
headers = { 'authorization': "Bearer YOUR_ACCESS_TOKEN_HERE" }
conn.request("get", "/%7ByourDomain%7D/api_path", headers=headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))
```
```ruby Ruby lines theme={null}
require 'uri'
require 'net/http'
url = URI("http:///%7ByourDomain%7D/api_path")
http = Net::HTTP.new(url.host, url.port)
request = Net::HTTP::Get.new(url)
request["authorization"] = 'Bearer YOUR_ACCESS_TOKEN_HERE'
response = http.request(request)
puts response.read_body
```
```swift Swift lines theme={null}
import Foundation
let headers = ["authorization": "Bearer YOUR_ACCESS_TOKEN_HERE"]
let request = NSMutableURLRequest(url: NSURL(string: "http:///%7ByourDomain%7D/api_path")! as URL,
cachePolicy: .useProtocolCachePolicy,
timeoutInterval: 10.0)
request.httpMethod = "get"
request.allHTTPHeaderFields = headers
let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
if (error != nil) {
print(error)
} else {
let httpResponse = response as? HTTPURLResponse
print(httpResponse)
}
})
dataTask.resume()
```
##### Punto de control
Ahora que ha configurado su aplicación, ejecútela para verificar que:
* `GET /api/public`esté disponible para solicitudes no autenticadas.
* `GET /api/private`esté disponible para solicitudes autenticadas.
* `GET /api/private-scoped`esté disponible para solicitudes autenticadas que contengan un
token de acceso con el `scope` `read:messages`.
## Próximos pasos
¡Excelente trabajo! Si llegaste hasta aquí, ya deberías tener el inicio de sesión, el cierre de sesión y la información del perfil de usuario funcionando en tu aplicación.
Aquí concluye nuestro tutorial de inicio rápido, pero hay mucho más por explorar. Para saber más sobre lo que puedes hacer con Auth0, consulta:
* [Auth0 Dashboard](https://manage.auth0.com/dashboard/us/dev-gja8kxz4ndtex3rq) - Aprenda a configurar y administrar su tenant de Auth0 y sus aplicaciones
* [SDK omniauth-auth0](https://github.com/auth0/omniauth-auth0) - Explora en más detalle el SDK utilizado en este tutorial
* [Auth0 Marketplace](https://marketplace.auth0.com/) - Descubra las integraciones que puede habilitar para ampliar las funcionalidades de Auth0
```rb app/controllers/concerns/secured.rb lines highlight={} theme={null}
# frozen_string_literal: true
module Secured
extend ActiveSupport::Concern
REQUIRES_AUTHENTICATION = { message: 'Requires authentication' }.freeze
BAD_CREDENTIALS = {
message: 'Bad credentials'
}.freeze
MALFORMED_AUTHORIZATION_HEADER = {
error: 'invalid_request',
error_description: 'Authorization header value must follow this format: Bearer access-token',
message: 'Bad credentials'
}.freeze
INSUFFICIENT_PERMISSIONS = {
error: 'insufficient_permissions',
error_description: 'The access token does not contain the required permissions',
message: 'Permission denied'
}.freeze
def authorize
token = token_from_request
return if performed?
validation_response = Auth0Client.validate_token(token)
@decoded_token = validation_response.decoded_token
return unless (error = validation_response.error)
render json: { message: error.message }, status: error.status
end
def validate_permissions(permissions)
raise 'validate_permissions needs to be called with a block' unless block_given?
return yield if @decoded_token.validate_permissions(permissions)
render json: INSUFFICIENT_PERMISSIONS, status: :forbidden
end
private
def token_from_request
authorization_header_elements = request.headers['Authorization']&.split
render json: REQUIRES_AUTHENTICATION, status: :unauthorized and return unless authorization_header_elements
unless authorization_header_elements.length == 2
render json: MALFORMED_AUTHORIZATION_HEADER,
status: :unauthorized and return
end
scheme, token = authorization_header_elements
render json: BAD_CREDENTIALS, status: :unauthorized and return unless scheme.downcase == 'bearer'
token
end
end
```
```rb app/controllers/application_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class ApplicationController < ActionController::API
include Secured
end
```
```rb app/lib/auth0_client.rb lines highlight={} theme={null}
```
```rb app/controllers/public_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class PublicController < ApplicationController
def public
render json: { message: 'All good. You don\'t need to be authenticated to call this.' }
end
end
```
```rb app/controllers/private_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class PublicController < ApplicationController
def public
render json: { message: 'All good. You don\'t need to be authenticated to call this.' }
end
end
```
```rb app/controllers/concerns/secured.rb lines highlight={} theme={null}
# frozen_string_literal: true
module Secured
extend ActiveSupport::Concern
REQUIRES_AUTHENTICATION = { message: 'Requires authentication' }.freeze
BAD_CREDENTIALS = {
message: 'Bad credentials'
}.freeze
MALFORMED_AUTHORIZATION_HEADER = {
error: 'invalid_request',
error_description: 'Authorization header value must follow this format: Bearer access-token',
message: 'Bad credentials'
}.freeze
INSUFFICIENT_PERMISSIONS = {
error: 'insufficient_permissions',
error_description: 'The access token does not contain the required permissions',
message: 'Permission denied'
}.freeze
def authorize
token = token_from_request
return if performed?
validation_response = Auth0Client.validate_token(token)
@decoded_token = validation_response.decoded_token
return unless (error = validation_response.error)
render json: { message: error.message }, status: error.status
end
def validate_permissions(permissions)
raise 'validate_permissions needs to be called with a block' unless block_given?
return yield if @decoded_token.validate_permissions(permissions)
render json: INSUFFICIENT_PERMISSIONS, status: :forbidden
end
private
def token_from_request
authorization_header_elements = request.headers['Authorization']&.split
render json: REQUIRES_AUTHENTICATION, status: :unauthorized and return unless authorization_header_elements
unless authorization_header_elements.length == 2
render json: MALFORMED_AUTHORIZATION_HEADER,
status: :unauthorized and return
end
scheme, token = authorization_header_elements
render json: BAD_CREDENTIALS, status: :unauthorized and return unless scheme.downcase == 'bearer'
token
end
end
```
```rb app/controllers/application_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class ApplicationController < ActionController::API
include Secured
end
```
```rb app/lib/auth0_client.rb lines highlight={} theme={null}
```
```rb app/controllers/public_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class PublicController < ApplicationController
def public
render json: { message: 'All good. You don\'t need to be authenticated to call this.' }
end
end
```
```rb app/controllers/private_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class PublicController < ApplicationController
def public
render json: { message: 'All good. You don\'t need to be authenticated to call this.' }
end
end
```
```rb app/controllers/application_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class ApplicationController < ActionController::API
include Secured
end
```
```rb app/lib/auth0_client.rb lines highlight={} theme={null}
```
```rb app/controllers/concerns/secured.rb lines highlight={} theme={null}
# frozen_string_literal: true
module Secured
extend ActiveSupport::Concern
REQUIRES_AUTHENTICATION = { message: 'Requires authentication' }.freeze
BAD_CREDENTIALS = {
message: 'Bad credentials'
}.freeze
MALFORMED_AUTHORIZATION_HEADER = {
error: 'invalid_request',
error_description: 'Authorization header value must follow this format: Bearer access-token',
message: 'Bad credentials'
}.freeze
INSUFFICIENT_PERMISSIONS = {
error: 'insufficient_permissions',
error_description: 'The access token does not contain the required permissions',
message: 'Permission denied'
}.freeze
def authorize
token = token_from_request
return if performed?
validation_response = Auth0Client.validate_token(token)
@decoded_token = validation_response.decoded_token
return unless (error = validation_response.error)
render json: { message: error.message }, status: error.status
end
def validate_permissions(permissions)
raise 'validate_permissions needs to be called with a block' unless block_given?
return yield if @decoded_token.validate_permissions(permissions)
render json: INSUFFICIENT_PERMISSIONS, status: :forbidden
end
private
def token_from_request
authorization_header_elements = request.headers['Authorization']&.split
render json: REQUIRES_AUTHENTICATION, status: :unauthorized and return unless authorization_header_elements
unless authorization_header_elements.length == 2
render json: MALFORMED_AUTHORIZATION_HEADER,
status: :unauthorized and return
end
scheme, token = authorization_header_elements
render json: BAD_CREDENTIALS, status: :unauthorized and return unless scheme.downcase == 'bearer'
token
end
end
```
```rb app/controllers/public_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class PublicController < ApplicationController
def public
render json: { message: 'All good. You don\'t need to be authenticated to call this.' }
end
end
```
```rb app/controllers/private_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class PublicController < ApplicationController
def public
render json: { message: 'All good. You don\'t need to be authenticated to call this.' }
end
end
```
```rb app/controllers/public_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class PublicController < ApplicationController
def public
render json: { message: 'All good. You don\'t need to be authenticated to call this.' }
end
end
```
```rb app/controllers/application_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class ApplicationController < ActionController::API
include Secured
end
```
```rb app/lib/auth0_client.rb lines highlight={} theme={null}
```
```rb app/controllers/concerns/secured.rb lines highlight={} theme={null}
# frozen_string_literal: true
module Secured
extend ActiveSupport::Concern
REQUIRES_AUTHENTICATION = { message: 'Requires authentication' }.freeze
BAD_CREDENTIALS = {
message: 'Bad credentials'
}.freeze
MALFORMED_AUTHORIZATION_HEADER = {
error: 'invalid_request',
error_description: 'Authorization header value must follow this format: Bearer access-token',
message: 'Bad credentials'
}.freeze
INSUFFICIENT_PERMISSIONS = {
error: 'insufficient_permissions',
error_description: 'The access token does not contain the required permissions',
message: 'Permission denied'
}.freeze
def authorize
token = token_from_request
return if performed?
validation_response = Auth0Client.validate_token(token)
@decoded_token = validation_response.decoded_token
return unless (error = validation_response.error)
render json: { message: error.message }, status: error.status
end
def validate_permissions(permissions)
raise 'validate_permissions needs to be called with a block' unless block_given?
return yield if @decoded_token.validate_permissions(permissions)
render json: INSUFFICIENT_PERMISSIONS, status: :forbidden
end
private
def token_from_request
authorization_header_elements = request.headers['Authorization']&.split
render json: REQUIRES_AUTHENTICATION, status: :unauthorized and return unless authorization_header_elements
unless authorization_header_elements.length == 2
render json: MALFORMED_AUTHORIZATION_HEADER,
status: :unauthorized and return
end
scheme, token = authorization_header_elements
render json: BAD_CREDENTIALS, status: :unauthorized and return unless scheme.downcase == 'bearer'
token
end
end
```
```rb app/controllers/private_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class PublicController < ApplicationController
def public
render json: { message: 'All good. You don\'t need to be authenticated to call this.' }
end
end
```
```rb app/controllers/private_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class PublicController < ApplicationController
def public
render json: { message: 'All good. You don\'t need to be authenticated to call this.' }
end
end
```
```rb app/controllers/application_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class ApplicationController < ActionController::API
include Secured
end
```
```rb app/lib/auth0_client.rb lines highlight={} theme={null}
```
```rb app/controllers/concerns/secured.rb lines highlight={} theme={null}
# frozen_string_literal: true
module Secured
extend ActiveSupport::Concern
REQUIRES_AUTHENTICATION = { message: 'Requires authentication' }.freeze
BAD_CREDENTIALS = {
message: 'Bad credentials'
}.freeze
MALFORMED_AUTHORIZATION_HEADER = {
error: 'invalid_request',
error_description: 'Authorization header value must follow this format: Bearer access-token',
message: 'Bad credentials'
}.freeze
INSUFFICIENT_PERMISSIONS = {
error: 'insufficient_permissions',
error_description: 'The access token does not contain the required permissions',
message: 'Permission denied'
}.freeze
def authorize
token = token_from_request
return if performed?
validation_response = Auth0Client.validate_token(token)
@decoded_token = validation_response.decoded_token
return unless (error = validation_response.error)
render json: { message: error.message }, status: error.status
end
def validate_permissions(permissions)
raise 'validate_permissions needs to be called with a block' unless block_given?
return yield if @decoded_token.validate_permissions(permissions)
render json: INSUFFICIENT_PERMISSIONS, status: :forbidden
end
private
def token_from_request
authorization_header_elements = request.headers['Authorization']&.split
render json: REQUIRES_AUTHENTICATION, status: :unauthorized and return unless authorization_header_elements
unless authorization_header_elements.length == 2
render json: MALFORMED_AUTHORIZATION_HEADER,
status: :unauthorized and return
end
scheme, token = authorization_header_elements
render json: BAD_CREDENTIALS, status: :unauthorized and return unless scheme.downcase == 'bearer'
token
end
end
```
```rb app/controllers/public_controller.rb lines highlight={} theme={null}
# frozen_string_literal: true
class PublicController < ApplicationController
def public
render json: { message: 'All good. You don\'t need to be authenticated to call this.' }
end
end
```
Regístrate para obtener una{" "}
cuenta de Auth0
{" "}
o{" "}
console.log("log in")}>
inicia sesión
{" "}
en tu cuenta existente para integrarte directamente con tu propio tenant.
Proporciona el Token de acceso como encabezado `Authorization` en tus solicitudes.