Inertia Rails Auth

Inertia Rails Authentication & Authorization

Guide to implementing authentication and authorization in Inertia Rails applications.

Key Principle

Inertia uses your existing Rails authentication infrastructure. No special OAuth or token-based auth required. Since your frontend and backend share the same domain, session-based auth works seamlessly.

Authentication with Devise

Setup

# Gemfile
gem 'devise'

bundle install
rails generate devise:install
rails generate devise User
rails db:migrate

Share Authentication State

# app/controllers/application_controller.rb
class ApplicationController  reset('password'),
    })
  }

  return (
    
      Sign In

      
        Email
         setData('email', e.target.value)}
          autoFocus
        />
        {errors.email && {errors.email}}
      

      
        Password
         setData('password', e.target.value)}
        />
      

      
        
           setData('remember', e.target.checked)}
          />
          Remember me
        
      

      
        {processing ? 'Signing in...' : 'Sign In'}
      

      
        Create an account
        Forgot password?
      
    
  )
}

Login Component (Vue)

import { useForm, Link } from '@inertiajs/vue3'

const form = useForm({
  email: '',
  password: '',
  remember: false,
})

function submit() {
  form.post('/users/sign_in', {
    onSuccess: () => form.reset('password'),
  })
}

  
    Sign In

    
      Email
      
      {{ form.errors.email }}
    

    
      Password
      
    

    
      
        
        Remember me
      
    

    
      {{ form.processing ? 'Signing in...' : 'Sign In' }}
    

    
      Create an account
      Forgot password?
    
  

Authentication with hassecurepassword

User Model

# app/models/user.rb
class User 
      Users

      {can.create_user && (
        
          Create User
        
      )}

      
        {users.map((user) => (
          
            {user.name}

            {user.can.edit && (
              Edit
            )}

            {user.can.delete && (
              
                Delete
              
            )}
          
        ))}
      
    
  )
}

Frontend Permission Checks (Vue)

import { Link, usePage } from '@inertiajs/vue3'

const props = defineProps(['users', 'can'])
const { auth } = usePage().props

  
    Users

    
    
      Create User
    

    
      
        {{ user.name }}

        
        
          Edit
        

        
          Delete
        
      
    
  

History Encryption

Prevent sensitive data exposure via browser back button after logout:

# config/initializers/inertia_rails.rb
InertiaRails.configure do |config|
  # Enable globally
  config.encrypt_history = true
end

# Or per-controller for sensitive areas
class Admin::BaseController  {
  const { auth } = usePage().props
  if (!auth.signed_in && requiresAuth(page.component)) {
    router.visit('/login')
  }
})

5. Implement Rate Limiting

# Gemfile
gem 'rack-attack'

# config/initializers/rack_attack.rb
Rack::Attack.throttle('login attempts', limit: 5, period: 60) do |req|
  req.ip if req.path == '/login' && req.post?
end

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: cole-robertson
• Source: cole-robertson/inertia-rails-skills
• License: MIT

Install and usage instructions live in the source repository linked above.