# A handful of basic Rails questions **URL:** \ **Category:** Rails\ **Created:** [July 14, 2006, 7:18pm UTC](https://www.ruby-forum.com/t/a-handful-of-basic-rails-questions/98437 "2006-07-14T19:18:15Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![davidjrice](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@davidjrice](https://www.ruby-forum.com/u/davidjrice)\ **Post date:** [July 14, 2006, 7:18pm UTC](https://www.ruby-forum.com/t/a-handful-of-basic-rails-questions/98437/1 "2006-07-14T19:18:15Z")
Alright, I’ve been programming with Rails for a little while now, and I really like what I see. I made a simple application for our clients that need to be able to view their personal and contact information, the ports they’re buying through our ISP, and communicate back and forth with us. The thing is - the application is pretty messy because I have been hired as a new programmer (virtually NO programming experience, save slight experience with PHP, C++, and HTML/CSS/JavaScript, and I do mean slight experience) and have had no formal training, so I’m having to learn everything by myself on the fly. The application I wrote runs entirely off of one controller. The port tracking, the communications and messaging, the login and sessions; all of it, one controller. From what I’ve read and seen about Rails, though, this is entirely not the way to do it. The application definitely works, but I don’t like how it’s done. I’m just glad my first really app works, though! I have another application I’m working on right now and I’m barely getting my feet wet with Ajax and I’ve recently discovered the joys of using partials. I’m ready to create an authentication system for this application, and I want some users to be able to access certain parts of the app and not others. If I create a login controller, will the authentication and session information carry over into other controllers? And what is the most graceful way to have most actions inaccessible until authenticated, without having to include something like redirect\_to “/login/” if !session[:userID] at the top of each action I want protected? (That’s how my first application does it, and I don’t like it.) Thanks, David ---
**Author:** ![davidjrice](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@davidjrice](https://www.ruby-forum.com/u/davidjrice)\ **Post date:** [July 14, 2006, 7:37pm UTC](https://www.ruby-forum.com/t/a-handful-of-basic-rails-questions/98437/2 "2006-07-14T19:37:09Z")
> And what is the most > graceful way to have most actions inaccessible until authenticated, > without having to include something like > > redirect\_to “/login/” if !session[:userID] > > at the top of each action I want protected? > Filters are what you want. class AccountController \< ApplicationController before\_filter :authenticate, :except =\> [:my\_unprotected\_action] def my\_unprotected\_action end end The filter method can be any method accessible from the controller. In this case, an authenticate method would probably need to be available to all controllers. As such you’d define it in the application controller: class ApplicationController def authenticate if !session[:user\_id] redirect\_to :controller =\> ‘user’, :action =\> ‘login’ end end end Best thing you can do is get hold of the ‘Agile…V2’ book: [http://www.pragmaticprogrammer.com/title/rails/](http://www.pragmaticprogrammer.com/title/rails/). It’s a great book that’ll get you started with all the Rails concepts and best practices. Hope that helps! Steve ---
**Author:** ![davidjrice](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@davidjrice](https://www.ruby-forum.com/u/davidjrice)\ **Post date:** [July 14, 2006, 7:37pm UTC](https://www.ruby-forum.com/t/a-handful-of-basic-rails-questions/98437/3 "2006-07-14T19:37:21Z")
This is a great way to employ a before\_filter. For example: before\_filter :require\_authorization, :except =\> [:login, :list, :show] Or something like that. There are several authorization and authentication plugins. I¹m using login engine/user engine, but if you want to understand how this works, read the Role Based Authentication recipe in Chad Fowler¹s ³Rails Recipes.² HTH ---
**Author:** ![davidjrice](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@davidjrice](https://www.ruby-forum.com/u/davidjrice)\ **Post date:** [July 14, 2006, 7:40pm UTC](https://www.ruby-forum.com/t/a-handful-of-basic-rails-questions/98437/4 "2006-07-14T19:40:32Z")
you might want to take a look at the login engine. [http://www.rails-engines.org/login\_engine/](http://www.rails-engines.org/login_engine/) [http://api.rails-engines.org/login\_engine/](http://api.rails-engines.org/login_engine/) Chris ---
**Author:** ![davidjrice](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@davidjrice](https://www.ruby-forum.com/u/davidjrice)\ **Post date:** [July 14, 2006, 8:01pm UTC](https://www.ruby-forum.com/t/a-handful-of-basic-rails-questions/98437/5 "2006-07-14T20:01:49Z")
Sam Livingston-Gray wrote: > (If you don’t know how inheritance works, go look it up; it’s part of > the magic of ActiveRecord.) Actually, it’s part of the magic of Ruby, and ActiveRecord isn’t part of the controllers at all. – Ola B. ([http://ola-bini.blogspot.com](http://ola-bini.blogspot.com)) JvYAML, RbYAML, JRuby and Jatha contributor System Developer, Karolinska Institutet ([http://www.ki.se](http://www.ki.se)) OLogix Consulting ([http://www.ologix.com](http://www.ologix.com)) “Yields falsehood when quined” yields falsehood when quined. ---
**Author:** ![davidjrice](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@davidjrice](https://www.ruby-forum.com/u/davidjrice)\ **Post date:** [July 14, 2006, 7:50pm UTC](https://www.ruby-forum.com/t/a-handful-of-basic-rails-questions/98437/6 "2006-07-14T19:50:04Z")
> If I create a login controller, will the authentication and session > information carry over into other controllers? Yes; everything in session is accessible to all controllers for as long as the user’s session is alive. You can take advantage of this to log people out if their last request was longer than 20 minutes ago, for example. As already mentioned, before filters are definitely the way to go here. Also keep in mind that any methods you put in the ApplicationController class will be inherited by all controllers, so you can put your before\_filter call there to automatically protect everything, then override it in, say, the login controller so that the login action doesn’t require login (which would be a problem). (If you don’t know how inheritance works, go look it up; it’s part of the magic of ActiveRecord.) It’s well worth dropping the cash on the three Pragmatic titles (Programming Ruby, AWDwR, and Rails Recipes). The tutorial in AWDwR offers good exposure to most of the Rails concepts. -Sam ---
**Author:** ![davidjrice](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@davidjrice](https://www.ruby-forum.com/u/davidjrice)\ **Post date:** [July 15, 2006, 2:47pm UTC](https://www.ruby-forum.com/t/a-handful-of-basic-rails-questions/98437/7 "2006-07-15T14:47:01Z")
On 7/14/06, David R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > The application I wrote runs entirely off of one controller. The port > tracking, the communications and messaging, the login and sessions; all of > it, one controller. From what I’ve read and seen about Rails, though, this > is entirely not the way to do it. As an aside, if one controller gets the job done, that’s fine-- you’ve done good! Don’t buy into dogma about how it’s ‘supposed’ to be done. Usually the _best_ solution is the easiest one. That seems to be especially true in Ruby. If your code is feeling overly complicated to you when doing Ruby, you’re doing something wrong. Step back and reconsider your approach 🙂 The application definitely works, but I don’t like how it’s done. I’m just > glad my first really app works, though! Now, that’s really what’s important isn’t it? > I have another application I’m working on right now and I’m barely getting > my feet wet with Ajax and I’ve recently discovered the joys of using > partials. I’m ready to create an authentication system for this > application, and I want some users to be able to access certain parts of the > app and not others. Having two controllers will make this easier, as the other’s have suggested. Put all of the protected stuff in a separate controller that has some authentication scheme on it. I’ll second the reccomendation for Chad Fowler’s Rails Recipes. He demystifies authentication and login controllers nicely. Howard ---
**Author:** ![davidjrice](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/5e9695/32.png) [@davidjrice](https://www.ruby-forum.com/u/davidjrice)\ **Post date:** [July 15, 2006, 4:20pm UTC](https://www.ruby-forum.com/t/a-handful-of-basic-rails-questions/98437/8 "2006-07-15T16:20:24Z")
> I’m ready to create an authentication system for this application, and I want some users \> to be able to access certain parts of the app and not others. I don’t know much about your requirements for authentication, but if you want your authenticated users to have different levels of access to your application, you are getting into authorization as well. If you do get Rails Recipes (highly recommended) the recipe after authentication is about authorization. BTW, if you really want to grok this stuff, Rails Recipes is great, but it’s high level. I also suggest: Agile Web D. With Rails (more in depth with Rails) Ruby for Rails (more in depth with Ruby, purpose-written for Rails developers) Programming Ruby (the definitive Ruby book) You’re in luck as a Ruby newbie; you have plenty of great documentation resources. Good luck with your app. -TJ