# Stop users accessing methods

**URL:** <https://www.ruby-forum.com/t/stop-users-accessing-methods/78992>\
**Category:** Rails\
**Created:** [March 9, 2006, 3:39pm UTC](https://www.ruby-forum.com/t/stop-users-accessing-methods/78992 "2006-03-09T15:39:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jjantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/dfb087/32.png) [@jjantz](https://www.ruby-forum.com/u/jjantz)\
**Post date:** [March 9, 2006, 3:39pm UTC](https://www.ruby-forum.com/t/stop-users-accessing-methods/78992/1 "2006-03-09T15:39:12Z")

</div>

Hello all.

Is there a way to stop users from being able to access a controllers  
methods without affecting the ability of other controllers to use them?

i.e

FooController  
def secret  
#Stuff  
end  
end

BarController

def index  
redirect\_to :controller =\> ‘foo’, action =\> ‘secret’, :id =\> ‘007’  
end  
end

But directly accessing the URL [server.com/foo/secret/007](http://server.com/foo/secret/007)

would return a “Not found” error?

It seems protected and private stop other controllers from accessing  
methods. I just want to stop users. (Or more specifically “Outside”  
requests not from a controller).

Is this possible in RoR?

Thanks

Jeff

---

<div class="post-metadata">

**Author:** ![jjantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/dfb087/32.png) [@jjantz](https://www.ruby-forum.com/u/jjantz)\
**Post date:** [March 9, 2006, 7:33pm UTC](https://www.ruby-forum.com/t/stop-users-accessing-methods/78992/2 "2006-03-09T19:33:54Z")

</div>

On 3/9/06, Jeff J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Is there a way to stop users from being able to access a controllers  
> methods without affecting the ability of other controllers to use them?

You can use a before filter to control access to the controller’s  
action. The way to do this securely is to authenticate the user  
somehow and check the authentication in the before filter.

> def index  
> redirect\_to :controller =\> ‘foo’, action =\> ‘secret’, :id =\> ‘007’  
> end  
> end
> 
> But directly accessing the URL [server.com/foo/secret/007](http://server.com/foo/secret/007)
> 
> would return a “Not found” error?

The only way to do this without authenticating users is checking the  
HTTP\_REFERER, but that is trivially forgible. If security matters,  
you should authenticate users and store the authentication information  
in the session, and check that in the before filter.

---

<div class="post-metadata">

**Author:** ![jjantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/dfb087/32.png) [@jjantz](https://www.ruby-forum.com/u/jjantz)\
**Post date:** [March 10, 2006, 1:46pm UTC](https://www.ruby-forum.com/t/stop-users-accessing-methods/78992/3 "2006-03-10T13:46:08Z")

</div>

> The only way to do this without authenticating users is checking the  
> HTTP\_REFERER, but that is trivially forgible. If security matters,  
> you should authenticate users and store the authentication information  
> in the session, and check that in the before filter.

Bugger, I was afraid of that. When I says “Users” in this case I just  
mean people using the website. It has no actual user/security framework.

Thanks

---

<div class="post-metadata">

**Author:** ![jjantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/dfb087/32.png) [@jjantz](https://www.ruby-forum.com/u/jjantz)\
**Post date:** [March 14, 2006, 6:48pm UTC](https://www.ruby-forum.com/t/stop-users-accessing-methods/78992/4 "2006-03-14T18:48:19Z")

</div>

> BarController  
> def index  
> flash[:from\_bar] = true  
> redirect\_to :controller =\> ‘foo’, action =\> ‘secret’, :id =\> ‘007’  
> end  
> end
> 
> FooController  
> def secret  
> unless flash[:from\_bar]  
> raise ::ActionController::UnknownAction, ‘no direct access  
> permitted’  
> end  
> #Stuff  
> end  
> end
> 
> –  
> We develop, watch us RoR, in numbers too big to ignore.

Oooohhh devious. Thanks very much. This isn’t really as a security  
implementation. Just to stop possibly silly curious users from messing  
around.

Jeff

---

<div class="post-metadata">

**Author:** ![jjantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/dfb087/32.png) [@jjantz](https://www.ruby-forum.com/u/jjantz)\
**Post date:** [March 10, 2006, 2:51pm UTC](https://www.ruby-forum.com/t/stop-users-accessing-methods/78992/5 "2006-03-10T14:51:35Z")

</div>

Jeff J. wrote:

> It seems protected and private stop other controllers from accessing  
> methods. I just want to stop users. (Or more specifically “Outside”  
> requests not from a controller).
> 
> Is this possible in RoR?

What I do for this is:

BarController  
def index  
flash[:from\_bar] = true  
redirect\_to :controller =\> ‘foo’, action =\> ‘secret’, :id =\> ‘007’  
end  
end

FooController  
def secret  
unless flash[:from\_bar]  
raise ::ActionController::UnknownAction, ‘no direct access  
permitted’  
end  
#Stuff  
end  
end

–  
We develop, watch us RoR, in numbers too big to ignore.