# More efficient way to manage access control with restful\_authentication?

**URL:** <https://www.ruby-forum.com/t/more-efficient-way-to-manage-access-control-with-restful-authentication/128086>\
**Category:** Rails\
**Created:** [February 4, 2008, 10:35pm UTC](https://www.ruby-forum.com/t/more-efficient-way-to-manage-access-control-with-restful-authentication/128086 "2008-02-04T22:35:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [February 4, 2008, 10:35pm UTC](https://www.ruby-forum.com/t/more-efficient-way-to-manage-access-control-with-restful-authentication/128086/1 "2008-02-04T22:35:59Z")

</div>

Hi,

I’m using restful\_authentication with the latest version of RoR.  
There are some actions that a user can only access if he is logged  
in. So I’m putting this check in my code:

```
    def new
        if logged_in?
            @user = User.find(session[:user_id])
            @ec_order = EcOrder.new
            1.times { @ec_order.ec_line_items.build }
        else
            flash[:notice] = "You must be logged in to access this

```

page."  
redirect\_to :controller =\> “register”, :action =\>  
“start”  
end  
end

I am repeatedly including this “if logged\_in?” action in many actions,  
and in some cases every action in a controller has this. What’s a  
better way to do this?

Thanks, - Dave

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [February 5, 2008, 12:59am UTC](https://www.ruby-forum.com/t/more-efficient-way-to-manage-access-control-with-restful-authentication/128086/2 "2008-02-05T00:59:38Z")

</div>

On Feb 4, 2008 1:35 PM, removed\_email\_address@domain.invalid  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> ```
> @ec_order = EcOrder.new
> 
> ```
> 
> and in some cases every action in a controller has this. What’s a  
> better way to do this?

If you’re using the login\_required before\_filter, you can override  
#authorized? to determine what actions that user can access. Just  
return false if they don’t have access and it’ll trigger the  
access\_denied method.

–  
Rick O.  
[http://lighthouseapp.com](http://lighthouseapp.com)  
[http://weblog.techno-weenie.net](http://weblog.techno-weenie.net)  
[http://mephistoblog.com](http://mephistoblog.com)

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [February 5, 2008, 2:42am UTC](https://www.ruby-forum.com/t/more-efficient-way-to-manage-access-control-with-restful-authentication/128086/3 "2008-02-05T02:42:11Z")

</div>

I can’t see that I’m using the login\_required before\_filter, but that  
sounds like the answer. How do I activate that? - Dave

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [February 5, 2008, 2:37pm UTC](https://www.ruby-forum.com/t/more-efficient-way-to-manage-access-control-with-restful-authentication/128086/4 "2008-02-05T14:37:14Z")

</div>

Try something like this in your controller:

If you dont need the exceptions, just drop them.

before\_filter :login\_required, :except =\> :show

You can also put it in your application controller (without  
the :except part), just make sure you skip this rule in the  
controllers that you need to actually login.

skip\_before\_filter :login\_required

Good luck!  
Ger Apeldoorn.

On Feb 5, 2:41 am, “removed\_email\_address@domain.invalid”