# \[newbie\] when authenticating a resource, do i need to cover PUT, DELETE, POST actions?

**URL:** <https://www.ruby-forum.com/t/newbie-when-authenticating-a-resource-do-i-need-to-cover-put-delete-post-actions/192847>\
**Category:** Rails\
**Created:** [August 6, 2010, 8:43pm UTC](https://www.ruby-forum.com/t/newbie-when-authenticating-a-resource-do-i-need-to-cover-put-delete-post-actions/192847 "2010-08-06T20:43:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lille](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/f4b2a3/32.png) [@Lille](https://www.ruby-forum.com/u/Lille)\
**Post date:** [August 6, 2010, 8:43pm UTC](https://www.ruby-forum.com/t/newbie-when-authenticating-a-resource-do-i-need-to-cover-put-delete-post-actions/192847/1 "2010-08-06T20:43:42Z")

</div>

Hi,

I’m using authentication with a :before\_filter for controller actions  
I want to restrict. I see that I’ll want to authenticate GET request  
actions, but what about PUT, DELETE, POST requests? Can anyone ‘get’  
to these latter requests if all GET requests on a resource are  
authenticated? In this same vein, how about covering ajax actions?

(The reason I don’t want to just protect everything is I don’t want to  
add tests unnecessarily…)

Thanks,

Lille

---

<div class="post-metadata">

**Author:** ![Lille](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/f4b2a3/32.png) [@Lille](https://www.ruby-forum.com/u/Lille)\
**Post date:** [August 6, 2010, 9:46pm UTC](https://www.ruby-forum.com/t/newbie-when-authenticating-a-resource-do-i-need-to-cover-put-delete-post-actions/192847/2 "2010-08-06T21:46:56Z")

</div>

On 6 August 2010 19:42, Lille [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hi,
> 
> I’m using authentication with a :before\_filter for controller actions  
> I want to restrict. I see that I’ll want to authenticate GET request  
> actions, but what about PUT, DELETE, POST requests? Can anyone ‘get’  
> to these latter requests if all GET requests on a resource are  
> authenticated? In this same vein, how about covering ajax actions?

I think all actions should be protected. Assume that any action url  
and request type can be generated by a hacker.

Colin