I have a work-in-progress branch for using Digest authentication with ActiveResource.
So, how did I do it? It wasn’t too hard actually. When I spiked, I changed ActiveResource::Connection#request to handle authentication itself. I ended up with a big mess: a new rescue clause, 10 lines of code to calculate the digest and so on. But I knew it would work. So, I git checkout . and started with tests, as it should.
The way ActiveResource is built, if a username / password is sent in, ActiveResource will send those automatically in an Authorization header, using the Basic authentication method. I need a way to turn this off. Thus grew #use_basic_authentication= and #use_digest_authentication=.
Next up, actually being able to calculate the Digest. A quick search turned up code by Eric Hodel in the form of a Ruby module: An implementation of HTTP Digest Authentication in Ruby
After a bit of cleanup and rewriting, I have a branch of ActiveResource that’s ready to be commented on. Please see francois/ar_digest and leave comments there.
An example of using Digest would be:
1 require "logger" 2 require "activeresource" 3 require "pp" 4 5 ActiveResource::Base.logger = Logger.new(STDERR) 6 7 ActiveResource::Base.site = "http://adgear.local/api" 8 ActiveResource::Base.user = "francois" 9 ActiveResource::Base.password = "my-funny-new-password-which-you've-never-seen-before" 10 ActiveResource::Base.timeout = 30 11 12 # Don't attempt Basic authentication, but be sure to use Digest 13 ActiveResource::Base.use_basic_authentication = false 14 ActiveResource::Base.use_digest_authentication = true 15 16 class Site < ActiveResource::Base 17 end 18 19 pp sites = Site.find(:all)
This work was sponsored by Bloom Digital Platforms, as part of my work on their AdGear API.
