# Login\_generator Restricting Specific Users

**URL:** <https://www.ruby-forum.com/t/login-generator-restricting-specific-users/60438>\
**Category:** Rails\
**Created:** [May 13, 2006, 7:13pm UTC](https://www.ruby-forum.com/t/login-generator-restricting-specific-users/60438 "2006-05-13T19:13:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![digitalpardoe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cc9497/32.png) [@digitalpardoe](https://www.ruby-forum.com/u/digitalpardoe)\
**Post date:** [May 13, 2006, 7:13pm UTC](https://www.ruby-forum.com/t/login-generator-restricting-specific-users/60438/1 "2006-05-13T19:13:18Z")

</div>

I have created a ‘admin’ controller and all the necessary definitions  
and templates to delete, update and edit records and this is working OK,  
but how do I effectively restrict access to these defs’ from all but the  
admin user (called admin)?

Currently I am just using if statements within the defs’ to check if it  
is the admin user logged in e.g;

def index  
if (@session[:user].login == ‘admin’)  
#perform actions  
end  
end

but this produces horrible error messages if accidentally navigated to.  
Is there a cleaner way of doing this?

Thanks in advance. Alex.

---

<div class="post-metadata">

**Author:** ![digitalpardoe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cc9497/32.png) [@digitalpardoe](https://www.ruby-forum.com/u/digitalpardoe)\
**Post date:** [May 14, 2006, 4:05am UTC](https://www.ruby-forum.com/t/login-generator-restricting-specific-users/60438/2 "2006-05-14T04:05:37Z")

</div>

If you define an “authorize” function in the admin controller, you can  
use it to choose if the user is allowed to see the action they’ve  
requested. If you return true, they’re authorized, false otherwise. For  
instance:

def authorize  
session[:user].is\_admin?  
end

---

<div class="post-metadata">

**Author:** ![digitalpardoe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cc9497/32.png) [@digitalpardoe](https://www.ruby-forum.com/u/digitalpardoe)\
**Post date:** [May 14, 2006, 5:17pm UTC](https://www.ruby-forum.com/t/login-generator-restricting-specific-users/60438/3 "2006-05-14T17:17:41Z")

</div>

Bryan D. wrote:

> If you define an “authorize” function in the admin controller, you can  
> use it to choose if the user is allowed to see the action they’ve  
> requested. If you return true, they’re authorized, false otherwise. For  
> instance:
> 
> def authorize  
> session[:user].is\_admin?  
> end

Hi,

Thanks for the quick response, I was wondering if you could give me a  
more complete example with how to implement your idea with regards to  
protecting an ‘index’ function perhaps because I can’t get it to work at  
all.

Alex

---

<div class="post-metadata">

**Author:** ![digitalpardoe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cc9497/32.png) [@digitalpardoe](https://www.ruby-forum.com/u/digitalpardoe)\
**Post date:** [May 13, 2006, 11:33pm UTC](https://www.ruby-forum.com/t/login-generator-restricting-specific-users/60438/4 "2006-05-13T23:33:28Z")

</div>

You need to make use of filters, by using before\_filter, and giving it a  
set  
of functions you’d like to filter. You can use the :except clause to  
filter  
everything but some function, typically index.

Thanks.