# Object Based Authorization **URL:** \ **Category:** Rails\ **Created:** [October 10, 2007, 7:07am UTC](https://www.ruby-forum.com/t/object-based-authorization/116837 "2007-10-10T07:07:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![dracos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@dracos](https://www.ruby-forum.com/u/dracos)\ **Post date:** [October 10, 2007, 7:07am UTC](https://www.ruby-forum.com/t/object-based-authorization/116837/1 "2007-10-10T07:07:46Z")
I need to restrict users from interacting with objects that do not belong\_to them (reference their id). For example, user #2 should not be able to load the page /events/show/3 if Event #3 has a user\_id of ‘1’. Anyone know of a clean solution for this at the controller level? ---
**Author:** ![dracos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@dracos](https://www.ruby-forum.com/u/dracos)\ **Post date:** [October 10, 2007, 11:20am UTC](https://www.ruby-forum.com/t/object-based-authorization/116837/2 "2007-10-10T11:20:15Z")
In the events controller add the following :before\_filter :do\_something\_checking, :only=\>[:show] do\_something\_checking is a method in the events controller that perform checking whether id is belong to the logged in user, and redirect to the warning page. On Oct 10, 1:07 pm, Peter M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![dracos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@dracos](https://www.ruby-forum.com/u/dracos)\ **Post date:** [October 10, 2007, 7:59pm UTC](https://www.ruby-forum.com/t/object-based-authorization/116837/3 "2007-10-10T19:59:05Z")
Peter M. wrote: > I need to restrict users from interacting with objects that do not > belong\_to them (reference their id). For example, user #2 should not be > able to load the page /events/show/3 if Event #3 has a user\_id of ‘1’. > Anyone know of a clean solution for this at the controller level? The built-in Rails association finds are your best bet. In this example URL: /objects/show/23 The controller might look like… user = User.find(session[:user\_id]) object = Object.find(params[:id]) If someone changes the ID in the URL, you have problems. However… user = User.find(session[:user\_id]) user.objects.find(params[:id]) Automatically searches for objects with the specified ID AND belong to the user. Jamis has an excellent write up on this… but I can’t find it. =( But here’s his website: [http://weblog.jamisbuck.org/](http://weblog.jamisbuck.org/) ---
**Author:** ![dracos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@dracos](https://www.ruby-forum.com/u/dracos)\ **Post date:** [October 11, 2007, 12:13am UTC](https://www.ruby-forum.com/t/object-based-authorization/116837/4 "2007-10-11T00:13:54Z")
Daniel W. wrote: > My mistake, it was Koz over at the Rails Way: > [http://www.therailsway.com/2007/3/26/association-proxies-are-your-friend](http://www.therailsway.com/2007/3/26/association-proxies-are-your-friend) Great suggestion and great link. Thanks Daniel. I ran into another problem however (and it looks like others have on the article’s discussion thread). I can’t seem to get this to work with a :through association. Using my initial example, if User has\_many :participants, :through =\> :events, I can’t use current\_user.participants without getting a LocalJumpError ‘no block given’. Anyone know a way around this? ---
**Author:** ![dracos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@dracos](https://www.ruby-forum.com/u/dracos)\ **Post date:** [October 10, 2007, 8:03pm UTC](https://www.ruby-forum.com/t/object-based-authorization/116837/5 "2007-10-10T20:03:43Z")
Daniel W. wrote: > The built-in Rails association finds are your best bet. > Automatically searches for objects with the specified ID AND belong to > the user. > > Jamis has an excellent write up on this… but I can’t find it. =( But > here’s his website: > [http://weblog.jamisbuck.org/](http://weblog.jamisbuck.org/) My mistake, it was Koz over at the Rails Way: [http://www.therailsway.com/2007/3/26/association-proxies-are-your-friend](http://www.therailsway.com/2007/3/26/association-proxies-are-your-friend) ---
**Author:** ![dracos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ea666f/32.png) [@dracos](https://www.ruby-forum.com/u/dracos)\ **Post date:** [October 11, 2007, 2:24am UTC](https://www.ruby-forum.com/t/object-based-authorization/116837/6 "2007-10-11T02:24:11Z")
Not sure about your specific issue. However there is a lot of good info about many to many relationships on Josh S.'s blog, [http://blog.hasmanythrough.com/](http://blog.hasmanythrough.com/) -Jamal