# How to restrict access to admin part of the page? **URL:** \ **Category:** Rails\ **Created:** [March 9, 2006, 6:03pm UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-admin-part-of-the-page/54599 "2006-03-09T18:03:32Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![g0nzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@g0nzo](https://www.ruby-forum.com/u/g0nzo)\ **Post date:** [March 9, 2006, 6:03pm UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-admin-part-of-the-page/54599/1 "2006-03-09T18:03:32Z")
Hi! What is the easiest way to restrict access to some part of the page? In php i just put .htaccess and .htpasswd files in /admin folder and it worked. Now i’ve got one admin folder for controllers, one for views, public folder and i’m not really sure if it’s still possible. So what is the easiest way? I don’t have any user logging features on my site, because i don’t need them. I want only to restric access to admin area. ---
**Author:** ![g0nzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@g0nzo](https://www.ruby-forum.com/u/g0nzo)\ **Post date:** [March 9, 2006, 6:17pm UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-admin-part-of-the-page/54599/2 "2006-03-09T18:17:11Z")
On 3/9/06, szymek [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I don’t have any user logging features on my site, because > i don’t need them. I want only to restric access to admin area. I’m not sure I follow you here. You want to restrict it to certain users, so it seems to me that you need some kind of user-tracking - or how do you know who your user is? In any case: I’d create (or copy) a login controller, then add a before\_filter to the controller for areas you want to restrict. – Joshua ---
**Author:** ![g0nzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@g0nzo](https://www.ruby-forum.com/u/g0nzo)\ **Post date:** [March 9, 2006, 6:38pm UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-admin-part-of-the-page/54599/3 "2006-03-09T18:38:44Z")
Well, you’re right, i wasn’t very clear about it. On php sites i had separate folder admin for all administration pages. I just put there .htaccess and .htpasswd files which forced user to log to gain access to this folder and all pages within it. That’s it. I didn’t write any line of logging code (if i didn’t need it of course). Is it possible to do the same - restrict access using just .htaccess and .htpasswd files instead of creating login controller and write a code? ---
**Author:** ![g0nzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@g0nzo](https://www.ruby-forum.com/u/g0nzo)\ **Post date:** [March 9, 2006, 7:05pm UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-admin-part-of-the-page/54599/4 "2006-03-09T19:05:23Z")
Thanks! I’ll probably choose acts\_as\_authenticated as it looks simpler. However it still would be much simpler to create 2 small files, than installing new plugin and creating new ‘users’ table, which will have only 1 user 🙂 ---
**Author:** ![g0nzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@g0nzo](https://www.ruby-forum.com/u/g0nzo)\ **Post date:** [March 9, 2006, 6:47pm UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-admin-part-of-the-page/54599/5 "2006-03-09T18:47:45Z")
On 3/9/06, szymek [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Well, you’re right, i wasn’t very clear about it. > > On php sites i had separate folder admin for all administration pages. I > just put there .htaccess and .htpasswd files which forced user to log to > gain access to this folder and all pages within it. That’s it. I didn’t > write any line of logging code (if i didn’t need it of course). > > Is it possible to do the same - restrict access using just .htaccess and > .htpasswd files instead of creating login controller and write a code? It’s outstandingly simple to add authentication to an existing Rails app. Check out acts\_as\_authenticated and/or LoginEngine for a couple of the many options available. [http://wiki.rubyonrails.com/rails/pages/Acts\_as\_authenticated](http://wiki.rubyonrails.com/rails/pages/Acts_as_authenticated) [http://rails-engines.org/login\_engine](http://rails-engines.org/login_engine) – James ---
**Author:** ![g0nzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@g0nzo](https://www.ruby-forum.com/u/g0nzo)\ **Post date:** [March 9, 2006, 8:42pm UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-admin-part-of-the-page/54599/6 "2006-03-09T20:42:32Z")
Maybe you’re right about writing my own very simple login controller. It would be probably faster using ruby, than installing and configuring the plugin 🙂 Is it a huge security hole if i put username/(encoded)password inside my controller? ---
**Author:** ![g0nzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@g0nzo](https://www.ruby-forum.com/u/g0nzo)\ **Post date:** [March 9, 2006, 8:25pm UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-admin-part-of-the-page/54599/7 "2006-03-09T20:25:48Z")
On 3/9/06, szymek [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > However it still would be much simpler to create 2 small files, than > installing new plugin and creating new ‘users’ table, which will have only 1 > user 🙂 1. In many cases, yes, but not all (especially shared) hosts allow .htaccess files, even for authentication. 2. It’s not _necessary_ to install a plugin, nor to create a users table. Those are alternatives to writing your own login controller. ---
**Author:** ![g0nzo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/3bc359/32.png) [@g0nzo](https://www.ruby-forum.com/u/g0nzo)\ **Post date:** [March 9, 2006, 8:59pm UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-admin-part-of-the-page/54599/8 "2006-03-09T20:59:32Z")
On 3/9/06, szymek [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Is it a huge security hole if i put username/(encoded)password inside my > controller? In general? I don’t think it’s a huge security hole.