# Restful\_authentication + nested resources =\> failed to authenticate

**URL:** <https://www.ruby-forum.com/t/restful-authentication-nested-resources-failed-to-authenticate/123157>\
**Category:** Rails\
**Created:** [December 14, 2007, 2:15pm UTC](https://www.ruby-forum.com/t/restful-authentication-nested-resources-failed-to-authenticate/123157 "2007-12-14T14:15:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kei\_Simone](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/839c29/32.png) [@Kei\_Simone](https://www.ruby-forum.com/u/Kei_Simone)\
**Post date:** [December 14, 2007, 2:15pm UTC](https://www.ruby-forum.com/t/restful-authentication-nested-resources-failed-to-authenticate/123157/1 "2007-12-14T14:15:15Z")

</div>

To all:

hi,

i used rails 1.2.6 + restful\_authentication plugin

#base\_url  
base = ‘/v1’

map.resources :users, :path\_prefix =\> base

map.resources :users do |users|  
users.resources :orders, :path\_prefix =\> ‘/v1/users/:id’  
end

map.resource :session

map.signup ‘/signup’, :controller =\> ‘users’, :action =\> ‘new’  
map.login ‘/login’, :controller =\> ‘session’, :action =\> ‘new’  
map.logout ‘/logout’, :controller =\> ‘session’, :action =\> ‘destroy’

this is my routes.rb

when i first started my webrick, i tried to access localhost:3001/v1/  
users/username1/orders  
i was prompted for my username password. so it worked.

however when i type in localhost:3001/logout

and when i try localhost:3001/v1/users/username1/orders, it failed to  
prompt me.

it showed

You have been logged out.  
Listing orders

exposing data when I have already logged out.

May I ask what is wrong here?

Thanks!

---

<div class="post-metadata">

**Author:** ![Kei\_Simone](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/839c29/32.png) [@Kei\_Simone](https://www.ruby-forum.com/u/Kei_Simone)\
**Post date:** [December 14, 2007, 2:49pm UTC](https://www.ruby-forum.com/t/restful-authentication-nested-resources-failed-to-authenticate/123157/2 "2007-12-14T14:49:50Z")

</div>

Forgot to mention that i also installed http\_authentication plugin as  
well.

---

<div class="post-metadata">

**Author:** ![Kei\_Simone](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/839c29/32.png) [@Kei\_Simone](https://www.ruby-forum.com/u/Kei_Simone)\
**Post date:** [December 14, 2007, 3:43pm UTC](https://www.ruby-forum.com/t/restful-authentication-nested-resources-failed-to-authenticate/123157/3 "2007-12-14T15:43:50Z")

</div>

Somehow my session is not destroyed.

what have i gone wrong?

inside my application.rb

# Filters

before\_filter :authenticate

# Sets @authenticated\_user if the user provides valid

# credentials. THis may be used to deny access or customise the view

def authenticate  
@authenticated\_user = nil  
authenticate\_with\_http\_basic do |user, password|

```
  @authenticated_user = User.authenticate(user, password)
end

return true

```

end

#Filter for actions that _require_ authentication. Unless client  
authenticated

# as some user, takes over the request and sends a response code of

1. 

def must\_authenticate  
if @authenticated\_user && (@user\_is\_viewing\_themselves != false)  
return true  
else  
request\_http\_basic\_authentication  
return false  
end  
end

# A filter for controllers beneath /users/{login}.

# Transforms {login} into user ID. Sends a 404 response code

# if the user does not exist.

def must\_specify\_user  
if params[:id]  
@user = User.find\_by\_permalink(params[:id])  
if\_found(@user) {params[:user\_id] = @user.id}  
return false unless @user  
end  
# for limiting view to authenticated user  
@user\_is\_viewing\_themselves = (@authenticated\_user == @user)  
return true  
end

in my orders\_controller i use before\_filter :must\_authenticate and  
before\_filter:must\_specify\_user