Rails API认证 #

class Api::V1::BaseController < ApplicationController
  before_action :authenticate_user!
  
  private
  
  def authenticate_user!
    token = request.headers['Authorization']&.split&.last
    @current_user = User.find_by(token: token)
    
    render json: { error: '未授权' }, status: :unauthorized unless @current_user
  end
end

# Gemfile
gem 'rack-attack'

# config/initializers/rack_attack.rb
Rack::Attack.throttle('api', limit: 100, period: 1.minute) do |request|
  request.ip
end