# Rails Authorization and Security question

**URL:** <https://www.ruby-forum.com/t/rails-authorization-and-security-question/172673>\
**Category:** Rails\
**Created:** [July 25, 2009, 3:14am UTC](https://www.ruby-forum.com/t/rails-authorization-and-security-question/172673 "2009-07-25T03:14:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rilindo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/c2a13f/32.png) [@rilindo](https://www.ruby-forum.com/u/rilindo)\
**Post date:** [July 25, 2009, 3:14am UTC](https://www.ruby-forum.com/t/rails-authorization-and-security-question/172673/1 "2009-07-25T03:14:01Z")

</div>

Working through the Users and Authentication of Learning Rails book  
(great book, code needs to be proof-read in a few cases, though), I  
came across this:

There’s still one leftover that may be worth addressing, depending on  
your security needs. The authorization? method has secured the data,  
and the view no longer shows the user options they can’t really use,  
but if a user knows the URL for the edit form, it will still open.  
It’s a GET request, after all. This is a good reason to make sure that  
these forms don’t display any information that isn’t publicly  
available through other means. If this is an issue, it may be worth  
the effort of adding authorization checks to every controller method  
that could spring a leak.

Any good reason why I do that instead of adding the checks to the view  
pages, like?

\<% if current\_user.admin? %\>

\<% else %\>  
\<don’t display page\>  
\<% end%\>

- Rilindo

---

<div class="post-metadata">

**Author:** ![rilindo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/c2a13f/32.png) [@rilindo](https://www.ruby-forum.com/u/rilindo)\
**Post date:** [July 25, 2009, 3:16am UTC](https://www.ruby-forum.com/t/rails-authorization-and-security-question/172673/2 "2009-07-25T03:16:57Z")

</div>

It would probably be easier to prevent users from viewing those pages  
using  
a filter. If you are using AuthenticatedSystem, you might be able to  
tap  
into the login\_required function. An example filter would be like

\<… in your controller class …\>  
before\_filter :login\_required, :except =\> [:show]

Hope that helps.

On Fri, Jul 24, 2009 at 8:41 PM, Rilindo F. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> every controller method that could spring a leak.
> 
> - 
> 
> >

# –

Jim  
[http://www.thepeoplesfeed.com/contribute](http://www.thepeoplesfeed.com/contribute)

---

<div class="post-metadata">

**Author:** ![rilindo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/c2a13f/32.png) [@rilindo](https://www.ruby-forum.com/u/rilindo)\
**Post date:** [July 25, 2009, 3:16am UTC](https://www.ruby-forum.com/t/rails-authorization-and-security-question/172673/3 "2009-07-25T03:16:57Z")

</div>

Hey, that is easier. I’ll have to save this.

Thanks!

---

<div class="post-metadata">

**Author:** ![rilindo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/c2a13f/32.png) [@rilindo](https://www.ruby-forum.com/u/rilindo)\
**Post date:** [July 25, 2009, 7:50am UTC](https://www.ruby-forum.com/t/rails-authorization-and-security-question/172673/4 "2009-07-25T07:50:16Z")

</div>

I am using Authlogic for authentification and  
rails\_authorization\_plugin for authorization

when needed, at the beginning of a controller I write

before\_filter :require\_user # can be also require\_no\_user to  
exclude multi-sessions from same user  
before\_filter :check\_authorization, :except =\> :index # to  
control access

and at the end of the controller , check for the all page access…  
can be also per action  
# If the user is not authorized, just throw the exception.  
def check\_authorization  
permit “superadmin or administrator” do  
return  
end  
render\_403  
end