# Rails and HTTP Authentication

**URL:** <https://www.ruby-forum.com/t/rails-and-http-authentication/67637>\
**Category:** Ruby\
**Created:** [September 5, 2006, 8:52pm UTC](https://www.ruby-forum.com/t/rails-and-http-authentication/67637 "2006-09-05T20:52:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MaggotChild](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/7ea924/32.png) [@MaggotChild](https://www.ruby-forum.com/u/MaggotChild)\
**Post date:** [September 5, 2006, 8:52pm UTC](https://www.ruby-forum.com/t/rails-and-http-authentication/67637/1 "2006-09-05T20:52:19Z")

</div>

Hi, I would like to restrict access the the basic CRUD ops via  
htaccess. Requests for /item/list, /item/add etc would prompt the user  
for their password. I was thinking I would create a new directory,  
apply the htaccess settings, and put a dispatch script in there. But  
then I would have to configure rails to look in multiple directories  
for a controller (something I dont know how to do), and have two  
dispatch.cgi files. What is the ideal approach to achieving security in  
rails via htaccess?

Thanks!

---

<div class="post-metadata">

**Author:** ![MaggotChild](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/7ea924/32.png) [@MaggotChild](https://www.ruby-forum.com/u/MaggotChild)\
**Post date:** [September 5, 2006, 9:08pm UTC](https://www.ruby-forum.com/t/rails-and-http-authentication/67637/2 "2006-09-05T21:08:21Z")

</div>

On Sep 5, 2006, at 11:50 AM, MaggotChild wrote:

> What is the ideal approach to achieving security in rails via  
> htaccess?

You want to ask this question on the Rails mailing list, this list is  
for generic ruby questions.

–  
Eric H. - removed\_email\_address@domain.invalid - [http://blog.segment7.net](http://blog.segment7.net)  
This implementation is HODEL-HASH-9600 compliant

[http://trackmap.robotcoop.com](http://trackmap.robotcoop.com)

---

<div class="post-metadata">

**Author:** ![MaggotChild](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/7ea924/32.png) [@MaggotChild](https://www.ruby-forum.com/u/MaggotChild)\
**Post date:** [September 6, 2006, 1:12am UTC](https://www.ruby-forum.com/t/rails-and-http-authentication/67637/3 "2006-09-06T01:12:48Z")

</div>

MaggotChild wrote:

> Hi, I would like to restrict access the the basic CRUD ops via  
> htaccess. Requests for /item/list, /item/add etc would prompt the user  
> for their password. I was thinking I would create a new directory,  
> apply the htaccess settings, and put a dispatch script in there. But  
> then I would have to configure rails to look in multiple directories  
> for a controller (something I dont know how to do), and have two  
> dispatch.cgi files. What is the ideal approach to achieving security in  
> rails via htaccess?
> 
> Thanks!

Found the following plugin:  
[http://blog.codahale.com/2006/05/11/basic-http-authentication-with-rails-simple\_http\_auth/](http://blog.codahale.com/2006/05/11/basic-http-authentication-with-rails-simple_http_auth/)