devise gem way to auth for a notification api

My app is using the devise gem for authentication. I have this video conversion service that can emit notification to a url of my choice, presumably so that the app knows the conversion is complete, basically, the notification is the same as someone clicking a button that says "conversion complete" but done programmatically.

I have created in the routes.rb file a route to this action which will mark a video as being successfully converted #routes.rb match "video/set_complete", "videos#set_complete"

#videos controller
def set_complete
   video = Video.find_by_conv_job_id(params[:encoding_id])
   video.set_complete
end

That api call from that video conversion service naturally carries a few other params to further identify the vid开发者_运维知识库eo. But I don't think it's that relevant.

Now here's the question, by the way, thanks for reading my post, I am forever indebted to you--- I mean, simply put, I can't just let anyone access that dns.com/videos/set_complete, that's why it is using Devise to authenticate, but I don't want to use user:pass@dns.com/videos/set_complete, what do I know, I just feel that the user/pass is in plain sight in a plain http (not s) request is quite dangerous. So I thought, well, assuming that the requests always come from a certain ip or domain name, can I make devise always authenticate these ip's requests without doing any embedded user/pass or the use of single access token?

Thanks again!

You can do something like this in your videos controller:

before_filter :check_ip, :only => [:set_complete]

def check_ip
  if request.remote_ip != '[ip address]'
    authenticate_user!
  end
end

This will let signed in users make that request unless they come from whatever IP address you've specified. If you want to ONLY allow requests to this action from that IP, change authenticate_user! to something like:

sign_out_and_redirect

However, since they don't care about the response, someone could just spoof the correct IP and be able to set things complete. I don't know how much you care about that though, and this is probably still sufficient for what you're doing.