# Securing URL with Rails

**URL:** <https://www.ruby-forum.com/t/securing-url-with-rails/141294>\
**Category:** Rails\
**Created:** [June 24, 2008, 12:50pm UTC](https://www.ruby-forum.com/t/securing-url-with-rails/141294 "2008-06-24T12:50:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joshua\_Jackson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c4cdca/32.png) [@Joshua\_Jackson](https://www.ruby-forum.com/u/Joshua_Jackson)\
**Post date:** [June 24, 2008, 12:50pm UTC](https://www.ruby-forum.com/t/securing-url-with-rails/141294/1 "2008-06-24T12:50:19Z")

</div>

Dear all,

How do we secure URL with rails? So only authenticated and authorized  
users allowed to view certain URL. Is there any configuration that I  
must set for this?

Many thanks

---

<div class="post-metadata">

**Author:** ![Joshua\_Jackson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c4cdca/32.png) [@Joshua\_Jackson](https://www.ruby-forum.com/u/Joshua_Jackson)\
**Post date:** [June 24, 2008, 1:35pm UTC](https://www.ruby-forum.com/t/securing-url-with-rails/141294/2 "2008-06-24T13:35:18Z")

</div>

Joshua Jackson wrote:

> Dear all,
> 
> How do we secure URL with rails? So only authenticated and authorized  
> users allowed to view certain URL. Is there any configuration that I  
> must set for this?
> 
> Many thanks

Well i guess its not the url but the method which needs to be  
secured…say suppose the edit page which is accessible only to the admin  
so in the method u can define that the logged in user should be  
admin…and thats how u can put restriction on the user to access that  
particular path / url

Hope this helps

Thanks

Dhaval P.  
Software Engineer  
Ruby on Rails

> **[RailsHouse : Ruby on Rails Development & Consulting, Waterloo, Canada](https://railshouse.com)**
>
> RailsHouse is Waterloo, Ontario based Ruby on Rails Consultancy firm which provides RoR Development, Migration, Staffing, Maintenace and Support Services

sales(AT)railshouse(DOT)com

---

<div class="post-metadata">

**Author:** ![Joshua\_Jackson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c4cdca/32.png) [@Joshua\_Jackson](https://www.ruby-forum.com/u/Joshua_Jackson)\
**Post date:** [June 24, 2008, 4:31pm UTC](https://www.ruby-forum.com/t/securing-url-with-rails/141294/3 "2008-06-24T16:31:38Z")

</div>

Hi guys,

First of all thanks very much for the response. But since I have no  
experience with Rails yet, could anyone give me a sample code? Also  
I’ve heard about restful\_authentification are able to do this? Does  
anyone know where can I get it? I’ve used gem but ended with no luck.

Many thanks,

---

<div class="post-metadata">

**Author:** ![Joshua\_Jackson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c4cdca/32.png) [@Joshua\_Jackson](https://www.ruby-forum.com/u/Joshua_Jackson)\
**Post date:** [June 24, 2008, 3:53pm UTC](https://www.ruby-forum.com/t/securing-url-with-rails/141294/4 "2008-06-24T15:53:32Z")

</div>

Dhaval’s right. small addition to his reply:

if you wanna secure a whole part of your url (speak yoururl/admin/\*  
for example) it’s probably the best to put

“before\_filter :validate\_login” and the implementation of your  
validate\_login-method

either into a specific-controller to secure this part of your webapp  
(i.e. admin\_controller.rb),  
or into the application\_controller.rb to secure your whole app.

That way Rails is always calling your validate\_login-method before  
calling the actual action.

Hope this works!

Good luck! Simon

On Jun 24, 1:35 pm, Dhaval P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![Joshua\_Jackson](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/c4cdca/32.png) [@Joshua\_Jackson](https://www.ruby-forum.com/u/Joshua_Jackson)\
**Post date:** [June 24, 2008, 9:20pm UTC](https://www.ruby-forum.com/t/securing-url-with-rails/141294/5 "2008-06-24T21:20:11Z")

</div>

Joshua,

There are plugin available that make this very easy to accomplish. My  
personal favorite, and the one I use for all my projects is  
restful\_authentication.

[http://agilewebdevelopment.com/plugins/restful\_authentication](http://agilewebdevelopment.com/plugins/restful_authentication)

Very easy to get started using this plugin and will give you the  
functionality that you’re looking for. Begin by reading the README  
included with the plugin. Then take a look at the files that get added  
to your ./lib directory of your project for more details.