Undesirable behaviour with multiple models on the same endpoint

[DuBistKomisch]

  acts_as_token_authentication_handler_for Guest, fallback: :none
  acts_as_token_authentication_handler_for User, fallback: :exception

In this case, user authentication works, but trying to authenticate as a guest returns 401. Same if fallback: :exception is removed and defaulted to :devise.

Both set to :exception 401s for everything, presumably since one always fails.

  acts_as_token_authentication_handler_for Guest, fallback: :none
  acts_as_token_authentication_handler_for User, fallback: :none

In this case, it works when authenticating as either. However, if neither authenticate, it doesn't return 401, it just proceeds into the method and typically 500s because of an error caused by current_guest/current_user being nil. This is the least bad option, but would still prefer a 401, without having to do it manually.

Note that it appears to work as expected when the two models are used for separate endpoints, you can even set both to fallback: :exception to 401 for both.

Basically the desired behaviour is like :none for both, but setting an overall fallback to :exception. This doesn't seem to be possible currently. Moreover the documentation implies that setting the last one has that effect, when it actually doesn't.

[bryantbj]

I am experiencing the same behavior. Drove me nuts for a while until I commented out my second line and it worked properly.

[feliperaul]

This seems like a duplicate of #330 (which is still unsolved). Got here by searching for other issues since I'm having the same problem as well. Posting here to reference and maybe manager can merge this issues.

[DuBistKomisch]

You mean it's a duplicate of this 😛

I have a workaround which does the job fine:

Define method to throw custom exception if neither current_X variable is set:

  def check_current_user_or_guest
    head :unauthorized unless current_user || current_guest
  end

Apply method before actions covered by simple token auth:

  acts_as_token_authentication_handler_for Guest, only: [:index, :show], fallback: :none
  acts_as_token_authentication_handler_for User, only: [:index, :show, :visit, :unvisit], fallback: :none

  before_action :check_current_user_or_guest, only: [:index, :show, :visit, :unvisit]

You can also just do it directly in the action method etc, and handle it differently.