# How to secure controller functions per user

**URL:** <https://www.ruby-forum.com/t/how-to-secure-controller-functions-per-user/124752>\
**Category:** Rails\
**Created:** [January 2, 2008, 7:32am UTC](https://www.ruby-forum.com/t/how-to-secure-controller-functions-per-user/124752 "2008-01-02T07:32:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bingobob](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e480ec/32.png) [@bingobob](https://www.ruby-forum.com/u/bingobob)\
**Post date:** [January 2, 2008, 7:32am UTC](https://www.ruby-forum.com/t/how-to-secure-controller-functions-per-user/124752/1 "2008-01-02T07:32:43Z")

</div>

I’ve got an app running that uses acts as attachment.

Works well and i’ve secured an admin area and an owners area.

Trouble is I now need to secure each action to ensure that people can’t  
just alter a url to edit another owners records. Any tips for doing  
this…?

I have a concept of a logged in owner. @owner = current\_owner.

Be grateful for any pointers, i’m looking for the simplest solution.

---

<div class="post-metadata">

**Author:** ![bingobob](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e480ec/32.png) [@bingobob](https://www.ruby-forum.com/u/bingobob)\
**Post date:** [January 2, 2008, 7:47am UTC](https://www.ruby-forum.com/t/how-to-secure-controller-functions-per-user/124752/2 "2008-01-02T07:47:08Z")

</div>

On Jan 1, 2008, at 10:32 PM, bingo bob wrote:

> I have a concept of a logged in owner. @owner = current\_owner.
> 
> ## Be grateful for any pointers, i’m looking for the simplest solution.

Don’t secure the controller method, secure the record. In a schema  
where:

User :has\_many Thingies

you can do:

current\_user.thingies.find(params[:id])

Where current\_user is typically instantiated by your authentication  
filter. This effectively scopes the find only to those thingies that  
belong to a particular user.

---

<div class="post-metadata">

**Author:** ![bingobob](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e480ec/32.png) [@bingobob](https://www.ruby-forum.com/u/bingobob)\
**Post date:** [January 2, 2008, 9:09am UTC](https://www.ruby-forum.com/t/how-to-secure-controller-functions-per-user/124752/3 "2008-01-02T09:09:20Z")

</div>

Thanks that’s fantastic. That sounds like a much more elegant idea, At  
least this way I don’t have to worry about securing each and every  
controller and additionally can control access in a single place.

One further point on this, I allow an “admin” (just a regular owner who  
I specify by name) access to everything. Can you advise how I’d  
implement that also?

---

<div class="post-metadata">

**Author:** ![bingobob](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/e480ec/32.png) [@bingobob](https://www.ruby-forum.com/u/bingobob)\
**Post date:** [January 2, 2008, 9:08pm UTC](https://www.ruby-forum.com/t/how-to-secure-controller-functions-per-user/124752/4 "2008-01-02T21:08:34Z")

</div>

On Jan 2, 2008, at 12:09 AM, bingo bob wrote:

> Thanks that’s fantastic. That sounds like a much more elegant idea, At  
> least this way I don’t have to worry about securing each and every  
> controller and additionally can control access in a single place.
> 
> One further point on this, I allow an “admin” (just a regular owner  
> who  
> I specify by name) access to everything. Can you advise how I’d  
> implement that also?

Good question. Obviously, you are moving more toward an ACL or role-  
based authentication system, so it’s not as simple as keeping people  
out of each others’ data. If you created a habtm relationship instead  
of has\_many, your data records could belong to both the user-level  
owner and also the admin. Just a thought.