# REST, limit method access **URL:** \ **Category:** Rails\ **Created:** [August 6, 2007, 11:48am UTC](https://www.ruby-forum.com/t/rest-limit-method-access/111346 "2007-08-06T11:48:41Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\ **Post date:** [August 6, 2007, 11:48am UTC](https://www.ruby-forum.com/t/rest-limit-method-access/111346/1 "2007-08-06T11:48:41Z")
Hi, I’m building a REST based app whereby a number of servers will submit data to the database using activerecord and the web frontend will merely view the data and provide reports. What is the easiest way to restrict create, update and delete to the remote servers using active record i.e., so that the web frontend can’t perform any changes to the database for certain controllers? Thanks, Toby ---
**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\ **Post date:** [August 6, 2007, 12:25pm UTC](https://www.ruby-forum.com/t/rest-limit-method-access/111346/2 "2007-08-06T12:25:50Z")
On 8/6/07, Toby C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > can’t perform any changes to the database for certain controllers? > > Thanks, > Toby On edge you should just be able to raise an appropriate error. ActionController::MethodNotAllowed ActionController::NotImplemented ActionController::UnknownAction Are all actions handled by edge. If your not on edge you can handle these errors by overwriting rescue\_action\_in\_public(exception) If you search this list or google there is plenty of information on that method. HTH Daniel ---
**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\ **Post date:** [August 6, 2007, 12:43pm UTC](https://www.ruby-forum.com/t/rest-limit-method-access/111346/3 "2007-08-06T12:43:52Z")
Oh ok thanks. What does edge do when one of those errors is raised? Do I explicitly need to rescue them or are they automatically handled? ---
**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\ **Post date:** [August 6, 2007, 12:56pm UTC](https://www.ruby-forum.com/t/rest-limit-method-access/111346/4 "2007-08-06T12:56:54Z")
Ok I’ll have a search. I’m using edge but only the latest stable revision so I hope it is supported there. How do I differentiate between a call from the web frontend and a call from activeresource? Are there tell tale signs of an activeresource call apart from the fact it asks for xml? ---
**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\ **Post date:** [August 6, 2007, 12:48pm UTC](https://www.ruby-forum.com/t/rest-limit-method-access/111346/5 "2007-08-06T12:48:54Z")
On 8/6/07, Toby C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > can’t perform any changes to the database for certain controllers? > > > Are all actions handled by edge. If your not on edge you can handle > > > these > > > errors by overwriting > > > rescue\_action\_in\_public(exception) > > > > If you search this list or google there is plenty of information on that > > method. > > > > HTH > > Daniel It’s handled automatically on edge I believe. It’s a pretty new feature. I saw a blog post on how to use it properly but I can’t seem to put my hands on it at the moment. ---
**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\ **Post date:** [August 6, 2007, 1:02pm UTC](https://www.ruby-forum.com/t/rest-limit-method-access/111346/6 "2007-08-06T13:02:54Z")
On 8/6/07, Toby C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Ok I’ll have a search. I’m using edge but only the latest stable > revision so I hope it is supported there. > > How do I differentiate between a call from the web frontend and a call > from activeresource? Are there tell tale signs of an activeresource > call apart from the fact it asks for xml? I’m guessing there’s not, but I am guessing. If you can change your data via xml, then I think you would need to allow it by xml in all cases. Just check that valid user data is supplied. If a user want’s to hack up the browser version so it submits via an xml action then they are going to. That’s if they use the browser at all if they wanted to be malicious. Best bet is to code it such that xml is allowed and leave it at that. I wouldn’t burn up braincells trying to worry about ALL the what-ifs a user can do to be bad. Just work out what you want to allow with your authorization permission and leave it at that. HTH Daniel ---
**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\ **Post date:** [August 6, 2007, 3:44pm UTC](https://www.ruby-forum.com/t/rest-limit-method-access/111346/7 "2007-08-06T15:44:17Z")
On 8/6/07, Toby C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Ok I’ll have a search. I’m using edge but only the latest stable > revision so I hope it is supported there. > > How do I differentiate between a call from the web frontend and a call > from activeresource? Are there tell tale signs of an activeresource > call apart from the fact it asks for xml? Nope, not really. Just check request.format.xml? if you want. – Rick O. [http://lighthouseapp.com](http://lighthouseapp.com) [http://weblog.techno-weenie.net](http://weblog.techno-weenie.net) [http://mephistoblog.com](http://mephistoblog.com)