Using doorkeeper without session management

Question

It appears the doorkeeper gem assumes you have a session from which to pull the current user from. At least that's the impression I get from config method resource_owner_authenticator. Is this correct?

I was hoping to implement a stateless (no sessions) REST only rails app where the user state is instead held in a signed JWT access token and is passed by the client to the server on every request. I'm using the access_token_generator to generate the signed JWT for the password grant flow.

Also doorkeeper_authorize! looks up the access token in the database to authenticate every request and check the token expiration. I would prefer to simply check the validity of the JWT signature and then verify the JWT is not expired using the exp claim in the JWT payload.

Is it possible to use a JWT access token in this way with doorkeeper? Perhaps I'm missing something obvious. I've already taken a look at doorkeeper-jwt but it doesn't address these concerns.

Answer 1

If you are using JWT why bother including Doorkeeper in the API server? Instead just write a before filter that gets the JWT from the header of an API call and uses the information in it to decide whether the call is valid and allowed. We are putting the roles that a user has into the JWT on all API calls and based on the roles making decisions. You could also use scopes in the JWT to make the decision.