# How to protect editing objects with individual passwords?

**URL:** <https://www.ruby-forum.com/t/how-to-protect-editing-objects-with-individual-passwords/175490>\
**Category:** Rails\
**Created:** [September 14, 2009, 6:11pm UTC](https://www.ruby-forum.com/t/how-to-protect-editing-objects-with-individual-passwords/175490 "2009-09-14T18:11:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adrian\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/cdc98d/32.png) [@Adrian\_D](https://www.ruby-forum.com/u/Adrian_D)\
**Post date:** [September 14, 2009, 6:11pm UTC](https://www.ruby-forum.com/t/how-to-protect-editing-objects-with-individual-passwords/175490/1 "2009-09-14T18:11:42Z")

</div>

Hi,

I have a model which has objects which should have always their own  
password.

If I want to edit object1 I will need password a.  
If I want to edit object2 I will need password b.

What is the best way to implement this? I am not sure whether I can  
accomplish this with the traditional authorisation methods.

Thanks for your help!

---

<div class="post-metadata">

**Author:** ![Adrian\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/cdc98d/32.png) [@Adrian\_D](https://www.ruby-forum.com/u/Adrian_D)\
**Post date:** [September 14, 2009, 9:43pm UTC](https://www.ruby-forum.com/t/how-to-protect-editing-objects-with-individual-passwords/175490/2 "2009-09-14T21:43:24Z")

</div>

Adrian D wrote:

> Hi,
> 
> I have a model which has objects which should have always their own  
> password.
> 
> If I want to edit object1 I will need password a.  
> If I want to edit object2 I will need password b.
> 
> What is the best way to implement this? I am not sure whether I can  
> accomplish this with the traditional authorisation methods.
> 
> Thanks for your help!

Best approach would be to add a password field to your model and take a  
password whenever an object is created, verify password when it is  
edited.

---

<div class="post-metadata">

**Author:** ![Adrian\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/cdc98d/32.png) [@Adrian\_D](https://www.ruby-forum.com/u/Adrian_D)\
**Post date:** [September 14, 2009, 10:50pm UTC](https://www.ruby-forum.com/t/how-to-protect-editing-objects-with-individual-passwords/175490/3 "2009-09-14T22:50:33Z")

</div>

Adrian D wrote:

> Hi,
> 
> I have a model which has objects which should have always their own  
> password.
> 
> If I want to edit object1 I will need password a.  
> If I want to edit object2 I will need password b.
> 
> What is the best way to implement this? I am not sure whether I can  
> accomplish this with the traditional authorisation methods.

Unless this is an isolated case, where you could hack something  
together, it sounds to me like you need support for Access Control Lists  
(ACL). Personally, I would not want to have each model aware of  
authorizations for itself. Authorization normally happens at a more  
abstract level.

I have not yet had the need for full ACLs in any of my Rails projects. I  
am aware there are some ACL plugins/gems available. Since I haven’t used  
them I don’t have any recommendations.