# How to Password Protect a Controller **URL:** \ **Category:** Rails\ **Created:** [March 30, 2006, 7:46am UTC](https://www.ruby-forum.com/t/how-to-password-protect-a-controller/93308 "2006-03-30T07:46:01Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![d6veteran](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/94ad74/32.png) [@d6veteran](https://www.ruby-forum.com/u/d6veteran)\ **Post date:** [March 30, 2006, 7:46am UTC](https://www.ruby-forum.com/t/how-to-password-protect-a-controller/93308/1 "2006-03-30T07:46:01Z")
Several of my models I want to password protect, so that only an admin can enter/destroy data. Is there an easy way to accomplish this by password protecting controllers? ---
**Author:** ![d6veteran](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/94ad74/32.png) [@d6veteran](https://www.ruby-forum.com/u/d6veteran)\ **Post date:** [March 30, 2006, 8:36am UTC](https://www.ruby-forum.com/t/how-to-password-protect-a-controller/93308/2 "2006-03-30T08:36:32Z")
Sure, have a look to the login generator (gem install login\_generator) -, then script/generate It’s very easy to use. ---
**Author:** ![d6veteran](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/94ad74/32.png) [@d6veteran](https://www.ruby-forum.com/u/d6veteran)\ **Post date:** [March 31, 2006, 9:16am UTC](https://www.ruby-forum.com/t/how-to-password-protect-a-controller/93308/3 "2006-03-31T09:16:32Z")
Christophe G. wrote: > Sure, have a look to the login generator (gem install login\_generator) > -, then script/generate > > It’s very easy to use. I tried that out, however it is exposed itself, allowing anyone to register and therefore be an admin (if I use it that way). What I’m trying to figure out is how to build in logic so that all the CRUD methods are gated. ---
**Author:** ![d6veteran](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/94ad74/32.png) [@d6veteran](https://www.ruby-forum.com/u/d6veteran)\ **Post date:** [March 31, 2006, 12:45pm UTC](https://www.ruby-forum.com/t/how-to-password-protect-a-controller/93308/4 "2006-03-31T12:45:45Z")
You can remove signup logic in controller. You must see the login\_generator as a tool to produce a skekelton with basic functionnalities, but it’s very clean and can easily tailored to suit your needs. ---
**Author:** ![d6veteran](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/94ad74/32.png) [@d6veteran](https://www.ruby-forum.com/u/d6veteran)\ **Post date:** [March 31, 2006, 1:20pm UTC](https://www.ruby-forum.com/t/how-to-password-protect-a-controller/93308/5 "2006-03-31T13:20:54Z")
I’m pretty happy with the login\_engine/user\_engine combo. LoginEngine provides the basic signup, login and password recovery functions and UserEngine adds simple role-based access control that you can tune down to single actions. My baseline user privileges are pretty much identical to a guest’s. Only those who have explicitly been assigned other roles have any privileges on protected controllers. Shut off new-account signup entirely – or restrict it to admins – and you should be all set if that’s what you want. Arch S. wrote: > Christophe G. wrote: > > > Sure, have a look to the login generator (gem install login\_generator) > > -, then script/generate > > > > It’s very easy to use. > > I tried that out, however it is exposed itself, allowing anyone to > register and therefore be an admin (if I use it that way). > > What I’m trying to figure out is how to build in logic so that all the > CRUD methods are gated. ---
**Author:** ![d6veteran](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/94ad74/32.png) [@d6veteran](https://www.ruby-forum.com/u/d6veteran)\ **Post date:** [March 31, 2006, 6:52pm UTC](https://www.ruby-forum.com/t/how-to-password-protect-a-controller/93308/6 "2006-03-31T18:52:35Z")
Steve K. wrote: > I’m pretty happy with the login\_engine/user\_engine combo. LoginEngine > provides the basic signup, login and password recovery functions and > UserEngine adds simple role-based access control that you can tune down > to single actions. My baseline user privileges are pretty much identical > to a guest’s. Only those who have explicitly been assigned other roles > have any privileges on protected controllers. > > Shut off new-account signup entirely – or restrict it to admins – and > you should be all set if that’s what you want. I cannot find the user\_engine gem. I wanted to look at some documentation before installing. Anyone have a link? Thanks. ---
**Author:** ![d6veteran](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/94ad74/32.png) [@d6veteran](https://www.ruby-forum.com/u/d6veteran)\ **Post date:** [March 31, 2006, 11:36pm UTC](https://www.ruby-forum.com/t/how-to-password-protect-a-controller/93308/7 "2006-03-31T23:36:56Z")
Have a look here : [http://rails-engines.org/](http://rails-engines.org/)