# Restful authentication (routes, resources etc)

**URL:** <https://www.ruby-forum.com/t/restful-authentication-routes-resources-etc/105006>\
**Category:** Rails\
**Created:** [May 24, 2007, 9:12pm UTC](https://www.ruby-forum.com/t/restful-authentication-routes-resources-etc/105006 "2007-05-24T21:12:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![johnlester](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@johnlester](https://www.ruby-forum.com/u/johnlester)\
**Post date:** [May 24, 2007, 9:12pm UTC](https://www.ruby-forum.com/t/restful-authentication-routes-resources-etc/105006/1 "2007-05-24T21:12:09Z")

</div>

Can anyone explain how restful authentication works? I have the plugin  
working to an extent. The only thing I can’t do is logout.

I’m assuming there are additional steps involved with adding methods to  
the  
users and sessions controllers due to the REST part.

Anyone?

---

<div class="post-metadata">

**Author:** ![johnlester](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@johnlester](https://www.ruby-forum.com/u/johnlester)\
**Post date:** [May 24, 2007, 9:20pm UTC](https://www.ruby-forum.com/t/restful-authentication-routes-resources-etc/105006/2 "2007-05-24T21:20:12Z")

</div>

The way I understand the implementation of restful authentication, the  
act of “logging out” is to destroy (think CRUD) a Session resource.

DELETE: [http://example.com/sessions/:id](http://example.com/sessions/:id)

---

<div class="post-metadata">

**Author:** ![johnlester](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@johnlester](https://www.ruby-forum.com/u/johnlester)\
**Post date:** [May 24, 2007, 9:46pm UTC](https://www.ruby-forum.com/t/restful-authentication-routes-resources-etc/105006/3 "2007-05-24T21:46:15Z")

</div>

That’s how I understand the plugin as well. But shouldn’t certain  
methods  
fall back to general POST/GET request methods as well?

I must be missing something, because I can’t specify the request method  
in  
an url. Can I? So, for instance to logout, link\_to(‘Logout’,  
:controller  
=\>‘sessions’, :action =\> ‘destroy’), should allow a user to logout.  
Even if  
I could, it’s not supported by most web servers so there has to be a  
workaround.

Does anyone know of any documentation on this plugin?

John

---

<div class="post-metadata">

**Author:** ![johnlester](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@johnlester](https://www.ruby-forum.com/u/johnlester)\
**Post date:** [May 25, 2007, 1:39am UTC](https://www.ruby-forum.com/t/restful-authentication-routes-resources-etc/105006/4 "2007-05-25T01:39:38Z")

</div>

John,

I took a closer look at this and found that what you need is already  
built into resful authentication.

Take a look at this link:  
\<%= link\_to “Logout”, session\_path(session), :method =\> :delete %\>

And the route.rb:

# Restful Authenticate routes

map.resources :users, :sessions

So you get the session\_path(session) for free!

---

<div class="post-metadata">

**Author:** ![johnlester](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@johnlester](https://www.ruby-forum.com/u/johnlester)\
**Post date:** [May 24, 2007, 10:01pm UTC](https://www.ruby-forum.com/t/restful-authentication-routes-resources-etc/105006/5 "2007-05-24T22:01:16Z")

</div>

On 5/24/07, John L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> That’s how I understand the plugin as well. But shouldn’t certain methods  
> fall back to general POST/GET request methods as well?
> 
> I must be missing something, because I can’t specify the request method in  
> an url. Can I? So, for instance to logout, link\_to(‘Logout’, :controller  
> =\>‘sessions’, :action =\> ‘destroy’), should allow a user to logout. Even if  
> I could, it’s not supported by most web servers so there has to be a  
> workaround.

You can just create a route for it if you want.

map.connect ‘logout’, :controller =\> ‘sessions’, :action =\> ‘destroy’

–  
Rick O.  
[http://lighthouseapp.com](http://lighthouseapp.com)  
[http://weblog.techno-weenie.net](http://weblog.techno-weenie.net)  
[http://mephistoblog.com](http://mephistoblog.com)