# Controller filter exludes w/ controller

**URL:** <https://www.ruby-forum.com/t/controller-filter-exludes-w-controller/114670>\
**Category:** Rails\
**Created:** [September 17, 2007, 1:24pm UTC](https://www.ruby-forum.com/t/controller-filter-exludes-w-controller/114670 "2007-09-17T13:24:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![eggie5](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/7c8e57/32.png) [@eggie5](https://www.ruby-forum.com/u/eggie5)\
**Post date:** [September 17, 2007, 1:24pm UTC](https://www.ruby-forum.com/t/controller-filter-exludes-w-controller/114670/1 "2007-09-17T13:24:02Z")

</div>

Hi, I have this before filter on my application controller for  
authentication purposes:

class ApplicationController \< ActionController::Base  
before\_filter :check\_authentication,  
:check\_authorization,  
:except =\> [:authentication, :login, :logout]

However, I have some controllers that I don’t even want authenticated.  
And as I understand it, expect only takes actions as parameters. How  
can I exclude based on controllers?

I’m starting to think my authentication model isn’t very flexible.  
It’s roles and rights recipe from the prag prog rails recipies book.

---

<div class="post-metadata">

**Author:** ![eggie5](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/7c8e57/32.png) [@eggie5](https://www.ruby-forum.com/u/eggie5)\
**Post date:** [September 17, 2007, 1:24pm UTC](https://www.ruby-forum.com/t/controller-filter-exludes-w-controller/114670/2 "2007-09-17T13:24:51Z")

</div>

Maybe I should move my authentication before\_filter check to only the  
controllers I want to guard with authentication, instead of in the  
application controller…

---

<div class="post-metadata">

**Author:** ![eggie5](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/7c8e57/32.png) [@eggie5](https://www.ruby-forum.com/u/eggie5)\
**Post date:** [September 25, 2007, 11:04pm UTC](https://www.ruby-forum.com/t/controller-filter-exludes-w-controller/114670/3 "2007-09-25T23:04:26Z")

</div>

> Maybe I should move my authentication before\_filter check to only the  
> controllers I want to guard with authentication, instead of in the  
> application controller…

Yes… or if you have many controllers that need to be authenticated do  
this:

class AuthenticatedController \< ApplicationController  
before\_filter…  
end

Then for those controllers do:

class MyAuthenticatedController \< AuthenticatedController.  
…  
end

Either way…

---

<div class="post-metadata">

**Author:** ![eggie5](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/7c8e57/32.png) [@eggie5](https://www.ruby-forum.com/u/eggie5)\
**Post date:** [September 25, 2007, 11:09pm UTC](https://www.ruby-forum.com/t/controller-filter-exludes-w-controller/114670/4 "2007-09-25T23:09:17Z")

</div>

You can also use:  
skip\_before\_filter  
in those controllers that don’t need it.

-Rob

On Sep 14, 2007, at 3:35 PM, Philip H. wrote:

> before\_filter…
> 
> > eggie5 wrote:
> > 
> > > And as I understand it, expect only takes actions as parameters. How  
> > > can I exclude based on controllers?
> > > 
> > > I’m starting to think my authentication model isn’t very flexible.  
> > > It’s roles and rights recipe from the prag prog rails recipies book.

Rob B. [http://agileconsultingllc.com](http://agileconsultingllc.com)  
removed\_email\_address@domain.invalid