# Require\_role on a per action basis

**URL:** <https://www.ruby-forum.com/t/require-role-on-a-per-action-basis/168880>\
**Category:** Rails\
**Created:** [May 27, 2009, 1:01am UTC](https://www.ruby-forum.com/t/require-role-on-a-per-action-basis/168880 "2009-05-27T01:01:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![asplake](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@asplake](https://www.ruby-forum.com/u/asplake)\
**Post date:** [May 27, 2009, 1:01am UTC](https://www.ruby-forum.com/t/require-role-on-a-per-action-basis/168880/1 "2009-05-27T01:01:28Z")

</div>

I am working on an app that has three roles (user, admin, business). I  
have the situation where all three roles interact with the same  
controller, but have access to different actions. Some actions are  
authorized for 2 roles (admin, business), and others are only authorized  
for one role (administrator).

Does anyone know if there is a commonly used pattern for security on a  
per action basis?

What I would like to do is be able to map which roles are authorized to  
call which actions and be able to call a :before\_filter in my  
controller.

In my head I’m thinking of something like

before\_filter :authorize\_action =\> :except [:public\_action1,  
:public\_action2]

Thanks for any input.

---

<div class="post-metadata">

**Author:** ![asplake](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@asplake](https://www.ruby-forum.com/u/asplake)\
**Post date:** [May 27, 2009, 1:38am UTC](https://www.ruby-forum.com/t/require-role-on-a-per-action-basis/168880/2 "2009-05-27T01:38:51Z")

</div>

Consider restful\_authentication and rolerequirement  
[http://code.google.com/p/rolerequirement/](http://code.google.com/p/rolerequirement/)

On May 26, 4:01 pm, Mike B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![asplake](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@asplake](https://www.ruby-forum.com/u/asplake)\
**Post date:** [May 27, 2009, 4:01am UTC](https://www.ruby-forum.com/t/require-role-on-a-per-action-basis/168880/3 "2009-05-27T04:01:27Z")

</div>

BenH wrote:

> Consider restful\_authentication

Yup. Or authlogic.

> and rolerequirement  
> [Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/rolerequirement/)

Or rails\_authorization.

There are probably other plugins as well – these are _very_ common  
tasks.

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![asplake](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@asplake](https://www.ruby-forum.com/u/asplake)\
**Post date:** [May 27, 2009, 10:42am UTC](https://www.ruby-forum.com/t/require-role-on-a-per-action-basis/168880/4 "2009-05-27T10:42:08Z")

</div>

Thanks for the links. Very appreciated. I will take a look at these  
_very_ common tasks.

Marnen Laibow-Koser wrote:

> BenH wrote:
> 
> > Consider restful\_authentication
> 
> Yup. Or authlogic.
> 
> > and rolerequirement  
> > [Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/rolerequirement/)
> 
> Or rails\_authorization.
> 
> There are probably other plugins as well – these are _very_ common  
> tasks.
> 
> ## Best,
> 
> Marnen Laibow-Koser  
> [http://www.marnen.org](http://www.marnen.org)  
> removed\_email\_address@domain.invalid