Best practice for integrating with Rails and Authentication

Decided to take a look at Stimulus for loading a few ui pieces after initial page rendering in one of our older Rails apps. Newer apps we’ve gone with more of the single page app backed with Rails API, but this seems like a great way of using it to load smaller elements and it works well so far.

What approach do you take to deal with the authentication issue. For example, our Devise login screen shows up in the fetched HTML since we are calling :authenticate_user! in the ApplicationController. I don’t want to ignore auth on the new routes for these partials as they may contain sensitive data, but it seems like implementing a complete JWT mechanism is overkill since it wouldn’t be needed everywhere.

[javan]

If you’re making fetch requests, add { credentials: 'same-origin' } to the options: https://github.com/github/fetch#sending-cookies

[sstephenson]

Closing this for now, but feel free to continue the conversation over on the new Stimulus Discourse.