# Detect XML Requests in Before Filter / OAuth

**URL:** <https://www.ruby-forum.com/t/detect-xml-requests-in-before-filter-oauth/143983>\
**Category:** Rails\
**Created:** [July 24, 2008, 12:01pm UTC](https://www.ruby-forum.com/t/detect-xml-requests-in-before-filter-oauth/143983 "2008-07-24T12:01:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nanosk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/a4c791/32.png) [@nanosk](https://www.ruby-forum.com/u/nanosk)\
**Post date:** [July 24, 2008, 12:01pm UTC](https://www.ruby-forum.com/t/detect-xml-requests-in-before-filter-oauth/143983/1 "2008-07-24T12:01:42Z")

</div>

Hi,

I am working on a RESTful website and also want to support XML as  
content type. However, I want to protect all XML actions with OAuth so  
that we can control, monitor and maybe limit access to the API in the  
future.

I installed the Rails oauth-plugin which works perfectly. I added this  
to the application controller:

before\_filter :require\_oauth\_for\_xml\_requests

def require\_oauth\_for\_xml\_requests  
if params[:format] == ‘xml’  
oauth\_required  
else  
true  
end  
end

The problem is that this only works if accessing something like  
‘/users.xml’. If HTTP headers are set instead I cannot detect the proper  
type. The action is not protected if I use:

curl -H ‘Accept: application/xml’ -H ‘Content-Type: application/xml’  
‘[http://localhost:3000/users](http://localhost:3000/users)’

The HTTP headers can be inspected in the request object but there are  
many combinations and it is probably not a good idea to just check if  
the content-type equals “application/xml” as it can also be placed at  
another position in the list.

How could my require\_oauth\_for\_xml\_requests method be fixed to detect  
all XML requests?

I would appreciate any help.

Thanks,  
Sascha

---

<div class="post-metadata">

**Author:** ![nanosk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/a4c791/32.png) [@nanosk](https://www.ruby-forum.com/u/nanosk)\
**Post date:** [July 24, 2008, 4:16pm UTC](https://www.ruby-forum.com/t/detect-xml-requests-in-before-filter-oauth/143983/2 "2008-07-24T16:16:47Z")

</div>

## Sure… and it’s reasonable to figure out why that’s not working for you

params[:format] is just whatever’s in the querystring. You want to check  
the  
actual request’s content type. From what I’ve seen you want to  
explicitly  
ask for the requested format.

def require\_oauth\_for\_xml\_requests  
if request.format.xml?  
oauth\_required  
else  
true  
end  
end

See if that works.

On Thu, Jul 24, 2008 at 5:01 AM, Sascha Konietzke \<

---

<div class="post-metadata">

**Author:** ![nanosk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/a4c791/32.png) [@nanosk](https://www.ruby-forum.com/u/nanosk)\
**Post date:** [July 25, 2008, 2:32pm UTC](https://www.ruby-forum.com/t/detect-xml-requests-in-before-filter-oauth/143983/3 "2008-07-25T14:32:26Z")

</div>

Thanks Brian, it works. This is was what I was looking for!