# Best way to protect pages with custom auth-system?

**URL:** <https://www.ruby-forum.com/t/best-way-to-protect-pages-with-custom-auth-system/197589>\
**Category:** Radiant CMS\
**Created:** [October 16, 2010, 9:09pm UTC](https://www.ruby-forum.com/t/best-way-to-protect-pages-with-custom-auth-system/197589 "2010-10-16T21:09:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![okkezSS](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/85f322/32.png) [@okkezSS](https://www.ruby-forum.com/u/okkezSS)\
**Post date:** [October 16, 2010, 9:09pm UTC](https://www.ruby-forum.com/t/best-way-to-protect-pages-with-custom-auth-system/197589/1 "2010-10-16T21:09:20Z")

</div>

I have a custom auth-system based on authlogic (based largely on  
reader extension).  
I have two roles: regular users and moderators.  
I also have two extra pages types, one is for moderators only, the  
other is for either.

Whats would be recommended way to require certain user role to access  
a particular page type?  
Should I define a custom process() method for each page or is there a  
better way?

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [October 29, 2010, 5:36am UTC](https://www.ruby-forum.com/t/best-way-to-protect-pages-with-custom-auth-system/197589/2 "2010-10-29T05:36:26Z")

</div>

On Sat, Oct 16, 2010 at 3:08 PM, swartz [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> 

I haven’t tried this myself.  
You could create a custom process, you could perhaps create a rack  
session and use [Setup · wardencommunity/warden Wiki · GitHub](http://github.com/hassox/warden/wiki/Setup)

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [October 29, 2010, 10:23am UTC](https://www.ruby-forum.com/t/best-way-to-protect-pages-with-custom-auth-system/197589/3 "2010-10-29T10:23:17Z")

</div>

On 29 Oct 2010, at 04:35, Jim G. wrote:

> > better way?  
> > reader\_group does something similar by overriding find\_page and  
> > show\_page in site\_controller, but I looking at it now I probably should  
> > just have chained Page#find\_by\_url and defined some new exception types  
> > for the controller to catch.

best,

will

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [November 1, 2010, 10:53pm UTC](https://www.ruby-forum.com/t/best-way-to-protect-pages-with-custom-auth-system/197589/4 "2010-11-01T22:53:54Z")

</div>

What I’ve done so far is to use around\_filter with process\_page from  
SiteController.  
But I find that the login in this overwritten method is expensive as  
it has to run and hit the database for every page.  
Just seeing if there’re better ways to do this.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [November 1, 2010, 10:57pm UTC](https://www.ruby-forum.com/t/best-way-to-protect-pages-with-custom-auth-system/197589/5 "2010-11-01T22:57:02Z")

</div>

I’m toying with the idea of caching the permissions, that is load them  
all up and their permission from table into memory and keep them  
there.  
So it doesn’t have to hit the database every time.  
The good thing is there’re only 200 pages and not 2,000.