# Authenticate, THEN redirect

**URL:** <https://www.ruby-forum.com/t/authenticate-then-redirect/188114>\
**Category:** Rails\
**Created:** [May 5, 2010, 11:41pm UTC](https://www.ruby-forum.com/t/authenticate-then-redirect/188114 "2010-05-05T23:41:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![trevoke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ee7513/32.png) [@trevoke](https://www.ruby-forum.com/u/trevoke)\
**Post date:** [May 5, 2010, 11:41pm UTC](https://www.ruby-forum.com/t/authenticate-then-redirect/188114/1 "2010-05-05T23:41:59Z")

</div>

Hi all.  
What I want to do:  
use HTTP Basic Authentication (stop screaming!) and then redirect to a  
welcome page.

What I am trying to do:  
Use a before filter which will authenticate and then redirect to the  
welcome page.

How I am failing (It’s a little ugly, but please bear with me - I’m  
trying to understand how this works):

class ApplicationController \< ActionController::Base  
helper :all

before\_filter :authenticate

protected

def authenticate  
authenticate\_or\_request\_with\_http\_basic do |username, password|  
user = User.first(:conditions =\> [‘username like ? and password  
like ?’, username, password])  
redirect\_to root\_path and return unless user.nil?  
user  
end  
end

end

How it is failing:  
It tells me there’s a render and a redirect.

Can anyone suggest something here? Am I just … Thinking about it the  
wrong way?

---

<div class="post-metadata">

**Author:** ![trevoke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ee7513/32.png) [@trevoke](https://www.ruby-forum.com/u/trevoke)\
**Post date:** [May 6, 2010, 3:08pm UTC](https://www.ruby-forum.com/t/authenticate-then-redirect/188114/2 "2010-05-06T15:08:03Z")

</div>

Aldric G. wrote:

> Hi all.  
> What I want to do:  
> use HTTP Basic Authentication (stop screaming!) and then redirect to a  
> welcome page.

Is this an exercise for learning? If it’s not then why would you even  
consider solving this already solved problem.

> **[GitHub - binarylogic/authlogic: A simple ruby authentication solution.](https://github.com/binarylogic/authlogic)**
>
> A simple ruby authentication solution. Contribute to binarylogic/authlogic development by creating an account on GitHub.

---

<div class="post-metadata">

**Author:** ![trevoke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ee7513/32.png) [@trevoke](https://www.ruby-forum.com/u/trevoke)\
**Post date:** [May 6, 2010, 3:34pm UTC](https://www.ruby-forum.com/t/authenticate-then-redirect/188114/3 "2010-05-06T15:34:50Z")

</div>

Robert W. wrote:

> Aldric G. wrote:
> 
> > Hi all.  
> > What I want to do:  
> > use HTTP Basic Authentication (stop screaming!) and then redirect to a  
> > welcome page.
> 
> Is this an exercise for learning? If it’s not then why would you even  
> consider solving this already solved problem.
> 
> [GitHub - binarylogic/authlogic: A simple ruby authentication solution.](http://github.com/binarylogic/authlogic)

Yes… Yes it is. I’d love to be using authlogic. 🙂

---

<div class="post-metadata">

**Author:** ![trevoke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ee7513/32.png) [@trevoke](https://www.ruby-forum.com/u/trevoke)\
**Post date:** [May 6, 2010, 3:42pm UTC](https://www.ruby-forum.com/t/authenticate-then-redirect/188114/4 "2010-05-06T15:42:36Z")

</div>

Hi,

You might want to check out this railscast tutorial  
([#82 HTTP Basic Authentication - RailsCasts](http://railscasts.com/episodes/82-http-basic-authentication)).

The authenticate\_or\_request\_with\_http\_basic method is expecting the  
block to return true or false and will send an auth required status if  
false. It should be ok to return the user object (ie the line after the  
redirect\_to …) as this should equate to true or false. I’m not sure  
what value it will return in the line ‘redirect\_to root\_path and return  
unless user.nil?’. There is also the problem that this before filter  
will endlessly redirect users to root\_path, unless you’ve told it to not  
authenticate the root\_path controller’s index action, which may be a  
security issue. You may want to set a session var on a successful  
authentication and then add an early out at the beginning if the session  
var is set, so the authentication and redirect\_to is only done once.  
Then there’s other issues like only storing passwords in hashed form  
using a salt value etc. Maybe something like the following untested  
code.

def authenticate  
return unless session[:user\_id].nil?  
authenticate\_or\_request\_with\_http\_basic do |username, password|  
user = User.first(:conditions =\> [‘username like ? and password like  
?’, username, password])  
if user  
session[:user\_id] = user.id  
redirect\_to root\_path  
true  
else  
false  
end  
end  
end

I hope this helps. I look forward to hearing how you go.

PS. There is nothing wrong with basic authentication if you’ve enabled  
SSL.

---

<div class="post-metadata">

**Author:** ![trevoke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ee7513/32.png) [@trevoke](https://www.ruby-forum.com/u/trevoke)\
**Post date:** [May 6, 2010, 4:29pm UTC](https://www.ruby-forum.com/t/authenticate-then-redirect/188114/5 "2010-05-06T16:29:03Z")

</div>

Brendan Brewster wrote:

> Hi,
> 
> def authenticate  
> return unless session[:user\_id].nil?  
> authenticate\_or\_request\_with\_http\_basic do |username, password|  
> user = User.first(:conditions =\> [‘username like ? and password like  
> ?’, username, password])  
> if user  
> session[:user\_id] = user.id  
> redirect\_to root\_path  
> true  
> else  
> false  
> end  
> end  
> end

Hi Brendan, I had indeed seen that railscasts episode. It helped, but  
didn’t say anything about the redirection.  
As far as your suggested code, it was exactly what the doctor ordered!  
Thanks for your help. I understand this a little better now.