# REST and security

**URL:** <https://www.ruby-forum.com/t/rest-and-security/185330>\
**Category:** Rails\
**Created:** [March 18, 2010, 11:31am UTC](https://www.ruby-forum.com/t/rest-and-security/185330 "2010-03-18T11:31:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pasalic\_Z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/48db29/32.png) [@Pasalic\_Z](https://www.ruby-forum.com/u/Pasalic_Z)\
**Post date:** [March 18, 2010, 11:31am UTC](https://www.ruby-forum.com/t/rest-and-security/185330/1 "2010-03-18T11:31:37Z")

</div>

Hi

we are creating small site on Rails which fits perfectly into REST  
model. One of our futures is security model with roles. In general,  
there are 3 types of users: standard, power-user and administrator. We  
need also to have different admin users with different roles. Also in  
other hand some users can have API access via RESTFUL interface.

Currently we are having standard CRUD interface via rest , something  
similar to scaffold generated code:

def index  
@data = SomeCodeWhichLoadData()  
respond\_to do |format|  
format.html # index.html.erb  
format.xml { render :xml =\> @profiles }  
end  
end

My problem is that i need to have standard rights (is user loged in),  
plus rights to check if user can have access to html parts (admin v.s.  
user v.s. power-user) and also part where i can limit some REST API to  
some users.

Is there any standard (Rails) way for doing this? Any ideas how to fit  
user rights model into rails app?

Best

---

<div class="post-metadata">

**Author:** ![Pasalic\_Z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/48db29/32.png) [@Pasalic\_Z](https://www.ruby-forum.com/u/Pasalic_Z)\
**Post date:** [March 18, 2010, 11:57am UTC](https://www.ruby-forum.com/t/rest-and-security/185330/2 "2010-03-18T11:57:23Z")

</div>

On 18 March 2010 10:30, Pasalic Z. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Is there any standard (Rails) way for doing this? Any ideas how to fit  
> user rights model into rails app?

Googling for “rails role based permissions” will give you several  
articles discussing this problem.  
The solution seems to be a) to roll your own, or b) use Aegis (or the  
newer CanCan) to handle it for you.

I’m using Aegis in my main current project, in combination with  
Clearance for authentication, but reading the CanCan docs, I’m very  
tempted to use that next time as it.

---

<div class="post-metadata">

**Author:** ![Pasalic\_Z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/48db29/32.png) [@Pasalic\_Z](https://www.ruby-forum.com/u/Pasalic_Z)\
**Post date:** [March 18, 2010, 12:52pm UTC](https://www.ruby-forum.com/t/rest-and-security/185330/3 "2010-03-18T12:52:05Z")

</div>

Michael P. wrote:

> On 18 March 2010 10:30, Pasalic Z. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> wrote:
> 
> > Is there any standard (Rails) way for doing this? Any ideas how to fit  
> > user rights model into rails app?
> 
> Googling for “rails role based permissions” will give you several  
> articles discussing this problem.  
> The solution seems to be a) to roll your own, or b) use Aegis (or the  
> newer CanCan) to handle it for you.
> 
> I’m using Aegis in my main current project, in combination with  
> Clearance for authentication, but reading the CanCan docs, I’m very  
> tempted to use that next time as it.

Declarative Authorization is another good option