Build a Secure API with Rails 8 - Part-2: Authentication Foundations

Short summary

Part 2 of a Rails 8 API security series covering authentication foundations with Devise, Doorkeeper, and JWT tokens stored in HttpOnly cookies. Implements OAuth2 password grant flow for user registration and login without storing credentials in localStorage. The author deliberately paces the series to establish secure foundations before tackling authorization and rate limiting.

• •Implements Devise + Doorkeeper + JWT with OAuth2 password grant for authentication
• •Stores tokens in encrypted HttpOnly cookies to prevent XSS token theft
• •Explains mental models: Devise for identity, Doorkeeper for access control, JWT for token format

Generated with AI, which can make mistakes.