# Redirection as POST to enable authentication for POST action

**URL:** <https://www.ruby-forum.com/t/redirection-as-post-to-enable-authentication-for-post-action/111149>\
**Category:** Rails\
**Created:** [August 3, 2007, 4:37am UTC](https://www.ruby-forum.com/t/redirection-as-post-to-enable-authentication-for-post-action/111149 "2007-08-03T04:37:52Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![jesseproudman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e274bd/32.png) [@jesseproudman](https://www.ruby-forum.com/u/jesseproudman)\
**Post date:** [August 3, 2007, 4:37am UTC](https://www.ruby-forum.com/t/redirection-as-post-to-enable-authentication-for-post-action/111149/1 "2007-08-03T04:37:52Z")

</div>

Hi all,

I am wondering if anyone can help me or has had similar experiences  
before:

I am trying to authenticate users before allowing them to access  
certain actions (create, update, destroy) in my controller, e.g.  
items\_controller. I have done this by using a before\_filter that  
redirects them to a users\_controller if session[:login] is nil. (e.g.  
items/update/25 redirects to users/login)

What I want to do is:

1. Preserve the original paramaters in all redirections (from items/  
update/25 to users/login, users/login to users/authenticate, and users/  
authenticate to items/update/25)
2. To make the authentication transparent to the actions (they need  
not care/know if the incoming request is a redirection due to  
authentication or if its a normal request).

I have come up with this incomplete solution:

1. I use flash to propagate the parameters (request.parameters) from  
items/update/25 to users/login to users/authenticate to items/update/
2. I wasnt able to use session variables because it doesnt seem to be  
preserved across controllers (im not so sure about the reason).
3. I manually inserted the parameters back into params by applying a  
before\_filter for the actions (create, update, destroy)

The problem I have for the above solution is:

1. Its not very transparent as I have to manually insert the  
parameters back to params, but worst of all
2. The redirection causes the request to become a GET not a POST and I  
have to turn off the verify code (the one generated by scaffolding)  
that restricts Create, Update, and Destroy actions to POST.

Does anyone have any advice for the above?

Best regards,

Jesse P.

---

<div class="post-metadata">

**Author:** ![jesseproudman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e274bd/32.png) [@jesseproudman](https://www.ruby-forum.com/u/jesseproudman)\
**Post date:** [August 3, 2007, 2:44pm UTC](https://www.ruby-forum.com/t/redirection-as-post-to-enable-authentication-for-post-action/111149/2 "2007-08-03T14:44:01Z")

</div>

See how restful\_authentication plugin does it.

Check #store\_location in  
[http://svn.techno-weenie.net/projects/plugins/restful\_authentication/generators/authenticated/templates/authenticated\_system.rb](http://svn.techno-weenie.net/projects/plugins/restful_authentication/generators/authenticated/templates/authenticated_system.rb)

On 8/3/07, Jesse P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> items/update/25 redirects to users/login)
> 
> 1. I use flash to propagate the parameters (request.parameters) from  
> have to turn off the verify code (the one generated by scaffolding)

–  
Cheers!

- Pratik  
[http://m.onkey.org](http://m.onkey.org)

---

<div class="post-metadata">

**Author:** ![jesseproudman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e274bd/32.png) [@jesseproudman](https://www.ruby-forum.com/u/jesseproudman)\
**Post date:** [August 5, 2007, 5:23am UTC](https://www.ruby-forum.com/t/redirection-as-post-to-enable-authentication-for-post-action/111149/3 "2007-08-05T05:23:22Z")

</div>

Hi Pratik,

I have read the code you mentioned and I doesnt even seem to save the  
parameters, yet along handle POST. It merely does redirect\_to from a  
saved URI.

Best regards,

Jesse

---

<div class="post-metadata">

**Author:** ![jesseproudman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e274bd/32.png) [@jesseproudman](https://www.ruby-forum.com/u/jesseproudman)\
**Post date:** [August 6, 2007, 9:42am UTC](https://www.ruby-forum.com/t/redirection-as-post-to-enable-authentication-for-post-action/111149/4 "2007-08-06T09:42:28Z")

</div>

Hi Shai,

Thanks for your comments. For the parameters, I am now using session  
variables and it works across controllers (im not sure why it didnt  
work the other time). But as for acts\_as\_authenticated, I have seen  
the code and it doesnt store any parameters from the original request.  
It merely stores the URI. After authentication, it redirects to the  
saved URI in the session variable. There are 2 problems with this:

1. I want to be able to save the parameters from the original request
2. I want to redirect as POST not GET to the original URI

In light of the above, I dont think acts\_as\_authenticated will work  
for me. In your experience, do you have any other possible  
suggestions?

Thanks,

Jesse

On Aug 5, 7:02 pm, Shai R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![jesseproudman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e274bd/32.png) [@jesseproudman](https://www.ruby-forum.com/u/jesseproudman)\
**Post date:** [August 5, 2007, 1:02pm UTC](https://www.ruby-forum.com/t/redirection-as-post-to-enable-authentication-for-post-action/111149/5 "2007-08-05T13:02:35Z")

</div>

Hi Jesse,

i don’t think you should be having the problems you’re having … an  
authenticated system is pretty straight-forward, and i think all the  
answers to your problems shouldn’t be too hard to catch, if using you’re  
using

[http://technoweenie.stikipad.com/plugins/show/Acts+as+Authenticated](http://technoweenie.stikipad.com/plugins/show/Acts+as+Authenticated)

there are docs and all…  
if you are using this, and are still having trouble, maybe you should  
paste some code so we can dig in a little bit to as what the exact  
problem is:

\*) passing variables via flash, is a pretty bad practice… i personally  
wouldn’t do that  
\*) session variables should definitely be passed through controllers, so  
that problem is probably more technical rather than a RoR problem. maybe  
u should post some code

---

<div class="post-metadata">

**Author:** ![jesseproudman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e274bd/32.png) [@jesseproudman](https://www.ruby-forum.com/u/jesseproudman)\
**Post date:** [August 6, 2007, 2:50pm UTC](https://www.ruby-forum.com/t/redirection-as-post-to-enable-authentication-for-post-action/111149/6 "2007-08-06T14:50:14Z")

</div>

I’m interested in this too. Something like this can occur if a user  
starts a form while authenticated, but then submits it after their  
authentication has timed out. I want to be able to reauthenticate them  
with a minimum of fuss and get back to handling their POST without  
making them start the form over again or back-button back to the form.

One possibility is to have the action allow GET requests in which case  
it looks in the session to see if there’s data intended for that action.  
But you’d have to do this for every single form-handling action.

Maybe it could be handled in ActionController’s before\_filter: if a GET  
request’s action matches the name of the action stored in the session  
data as the intended target for the session’s stored POST data, then  
stuff that session data into params.

I’m a little concerned about such session data getting orphaned or  
stale. If the user failed to authenticate, or just wandered off  
somewhere else, how would that session data get removed? What happens if  
they start the form over differently with old form data still sitting in  
their session?

I don’t think there’s a way to redirect as a POST request. A redirect is  
just a message to the user’s browser saying, hey, this page has moved,  
here’s the new address, and it’s up to the browser to decide what to do,  
and they all just submit GET requests for the new page.

This issue seems like such an obvious thing, that it makes me worried  
that there isn’t an obvious rails pattern or plug-in for this. Maybe  
other designers are punting on this or designing apps in such a way that  
it never comes up.

---

<div class="post-metadata">

**Author:** ![jesseproudman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e274bd/32.png) [@jesseproudman](https://www.ruby-forum.com/u/jesseproudman)\
**Post date:** [August 6, 2007, 4:30pm UTC](https://www.ruby-forum.com/t/redirection-as-post-to-enable-authentication-for-post-action/111149/7 "2007-08-06T16:30:26Z")

</div>

> This issue seems like such an obvious thing, that it makes me worried  
> that there isn’t an obvious rails pattern or plug-in for this. Maybe  
> other designers are punting on this or designing apps in such a way that  
> it never comes up.

Bingo, check out the restful\_authentication plugin.

[http://technoweenie.stikipad.com/plugins/show/Acts+as+Authenticated](http://technoweenie.stikipad.com/plugins/show/Acts+as+Authenticated)  
[http://svn.techno-weenie.net/projects/plugins/restful\_authentication/](http://svn.techno-weenie.net/projects/plugins/restful_authentication/)  
[http://svn.techno-weenie.net/projects/plugins/acts\_as\_authenticated/](http://svn.techno-weenie.net/projects/plugins/acts_as_authenticated/)

–  
Rick O.  
[http://lighthouseapp.com](http://lighthouseapp.com)  
[http://weblog.techno-weenie.net](http://weblog.techno-weenie.net)  
[http://mephistoblog.com](http://mephistoblog.com)

---

<div class="post-metadata">

**Author:** ![jesseproudman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e274bd/32.png) [@jesseproudman](https://www.ruby-forum.com/u/jesseproudman)\
**Post date:** [August 6, 2007, 5:38pm UTC](https://www.ruby-forum.com/t/redirection-as-post-to-enable-authentication-for-post-action/111149/8 "2007-08-06T17:38:27Z")

</div>

Rick,

I looked at restful\_authentication (just your second link). I see it  
storing the url to redirect back to after authentication  
(authenticated\_system.rb#login\_required -\> access\_denied -\>  
store\_location), but I don’t see it storing POST data (params) for later  
use. Where does that happen?