Tag Archives: Ruby

Making a POST request to a Rails API Endpoint

Here's a rare super-technical blog post. I spent enough time struggling with this seemingly simple problem today, that I felt I should share the answer.

The problem: You're designing a REST API for your Rails app. You want to let people insert records in your application via a POST request. However they submit their POST request via their 3rd party application, and your app throws an InvalidAuthenticityToken exception. Why is this happening?

The background: Ruby on Rails stores an authenticity token for each session, and submits this token as a hidden form field in any POST request upon a form submission. It does this to authenticate that the request is actually coming as a form submission through the web site, as opposed to a random POST request generated from CURL or another tool. A 3rd party application developer certainly doesn't have a token assigned and therefore can't submit this via their API request.

The solution: Rails only checks for the authenticity token in the case of a form submission. If you submit your data as content-type application/xml or application/json, then the token is not required. As a result you can set the content type appropriately and encode your input parameters as either xml or json. See the below gist for a ruby example.

It was hard to find this solution via google. Anyone know a smoother solution? Does the API designer generally disable forgery protection in this scenario on POST endpoints for inserting data via an API? Let me know in the comments or on twitter @petkanics

Thank You Heroku, or “How To Eliminate Sysadminning”

Picture_3

I need to take a couple minutes here to do something I've been meaning to for along time: Thank Heroku for being so baller.

For those of you not in the know, Heroku is an all-in-one Ruby platform built on top of Amazon web services. If you're a Ruby developer, and you are creating a web application, I highly recommend checking it out.

I've been using Heroku on two applications, including JumpPost, which officially launched today via a nice writeup on the Thrillist NYC site and newsletter. I'd like to share a couple reasons why I love the Heroku platform and would advise any agile startup to consider using it to get their product launched quickly.

Heroku is fast
The same could be said for any well configured EC2 instance, but don't underestimate the words well configured. The smart folks at Heroku have fine tuned every layer of the stack from using the fastest web servers (nginx), caches (Varnish, Memcache), and load balancing strategies.

Heroku is scalable
At the core of Heroku's architecture is a pre-compiled version of your application called a "slug" which is ready to be deployed in seconds to as many instances as you desire. Expecting a big press hit, or noticing your request queue filling up, just type a simple command and add more resources in seconds. Your users won't even know.

Heroku is easy
To deploy you literally type one command at the command line. They provide add-ons for caching, email, DNS, performance monitoring, custom domains, etc…many of them free. 

Heroku provides killer support
Not only does the staff respond to tickets and support requests within minutes, but they go overboard to support the latest and greatest Ruby features. They're very active on the newsgroup, and they even provide sample code for how to best utilize their architecture. 

Heroku is cost-effective
People may argue me on this one, because at face value the cost is actually rather expensive (think 2x the regular price of AWS). But these people aren't taking into account the cost of their own time when it comes to sysadminning, troubleshooting, not the mention the cost of downtime. Heroku never goes down, and it eliminates the need to pay a sysadmin (or the time value of sysadminning yourself).

Heroku is beautiful
Don't believe me? Check out their pricing page (yes they know their demographic are samurai loving programmers). Navigating their site to manage add-ons, monitor performance, and scale up and down resources is a pleasure.

With all of the above, there are a couple downsides that people should be aware of. Proper SSL is expensive, and should your app face custom scaling needs or challenges then you are locked into their stack. Fortunately their stack is designed for large scale use. The Heroku folks are well aware of these concerns, and they're very open about what they're doing to improve the experience for all of their customers. For startups getting their product off the ground, the time savings early on far outweigh the cost of figuring out a custom solution later should your product achieve grand scale. In case you couldn't tell, I'm a big fan.

If you have any questions about the platform, don't hesitate to email me at petkanics@gmail.com.