# How to password protect CRUD pages

**URL:** <https://www.ruby-forum.com/t/how-to-password-protect-crud-pages/133907>\
**Category:** Rails\
**Created:** [April 4, 2008, 8:58pm UTC](https://www.ruby-forum.com/t/how-to-password-protect-crud-pages/133907 "2008-04-04T20:58:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bmcelhany](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/a88e57/32.png) [@bmcelhany](https://www.ruby-forum.com/u/bmcelhany)\
**Post date:** [April 4, 2008, 8:58pm UTC](https://www.ruby-forum.com/t/how-to-password-protect-crud-pages/133907/1 "2008-04-04T20:58:17Z")

</div>

Hi all,

I’m in the process of working through my first rails app and had a  
general security question. For simplicity’s sake, let’s say I’ve got  
an Article object with all of the scaffolding-generated files  
(article.rb, articles\_controller.rb and all of the list/edit/new/etc  
views).

For obvious security reasons, I need to make sure all of these views  
are only accessible to admins, since they all have links to add/edit/  
delete the articles.

I’ve also created two additional views which basically mirror the list  
and show views…the only difference being there are no add/edit/  
delete links…everything is just read-only. These will be the public-  
facing views.

My question is basically, how do I structure my application so that  
any view and/or controller action that modifies the database is  
password protected, while any “read-only” view that I’ve created is  
accessible to the general public?

Thanks in advance for your help!

-Brian

---

<div class="post-metadata">

**Author:** ![bmcelhany](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/a88e57/32.png) [@bmcelhany](https://www.ruby-forum.com/u/bmcelhany)\
**Post date:** [April 4, 2008, 11:02pm UTC](https://www.ruby-forum.com/t/how-to-password-protect-crud-pages/133907/2 "2008-04-04T23:02:51Z")

</div>

Check out restful\_authentication, and you can use before\_filters to keep  
out the unwanted, like:

before\_filter :login\_required, :except =\> [:index, :show]

You don’t have to login to see the list, or look at a single item

and you can use the logged\_in? method to protect your edit/destroy links

---

<div class="post-metadata">

**Author:** ![bmcelhany](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/a88e57/32.png) [@bmcelhany](https://www.ruby-forum.com/u/bmcelhany)\
**Post date:** [April 7, 2008, 11:39pm UTC](https://www.ruby-forum.com/t/how-to-password-protect-crud-pages/133907/3 "2008-04-07T23:39:38Z")

</div>

Excellent, thanks for the advice!