# Unauthorised unless request.format.xml?

**URL:** <https://www.ruby-forum.com/t/unauthorised-unless-request-format-xml/111630>\
**Category:** Rails\
**Created:** [August 9, 2007, 11:04am UTC](https://www.ruby-forum.com/t/unauthorised-unless-request-format-xml/111630 "2007-08-09T11:04:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\
**Post date:** [August 9, 2007, 11:04am UTC](https://www.ruby-forum.com/t/unauthorised-unless-request-format-xml/111630/1 "2007-08-09T11:04:29Z")

</div>

Hi,

I’m using REST in my controller so therefore using respond to blocks  
but I’d like to return an unauthorised header for certain methods  
(create, update, delete) unless the request is for xml.

I don’t want any actions to be performed unless the request format is  
xml.

So far I have tried:

# POST /top\_talkers

# POST /top\_talkers.xml

def create  
head :status =\> :unauthorized unless request.format.xml?  
############ \<============  
@top\_talker = TopTalker.new(params[:top\_talker])

```
respond_to do |format|
  if @top_talker.save
    format.xml { render :xml => @top_talker, :status

```

=\> :created, :location =\> @top\_talker }  
else  
format.xml { render :xml =\> @top\_talker.errors, :status  
=\> :unprocessable\_entity }  
end  
end  
end

but that just gives a double render error.

Thanks,  
Toby

---

<div class="post-metadata">

**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\
**Post date:** [August 9, 2007, 11:58am UTC](https://www.ruby-forum.com/t/unauthorised-unless-request-format-xml/111630/2 "2007-08-09T11:58:34Z")

</div>

unless request.format.xml?  
head :status =\> :unauthorized  
render :nothing =\> true and return  
end

Should work.  
Vish

---

<div class="post-metadata">

**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\
**Post date:** [August 9, 2007, 2:26pm UTC](https://www.ruby-forum.com/t/unauthorised-unless-request-format-xml/111630/3 "2007-08-09T14:26:55Z")

</div>

I’ve put that in a method called method\_allowed? in application.rb and  
set it as a before\_filter for the methods I want to restrict access to  
but when the before\_filter is called I get a double render error. The  
respond to block still appears to execute.

---

<div class="post-metadata">

**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\
**Post date:** [August 12, 2007, 4:44am UTC](https://www.ruby-forum.com/t/unauthorised-unless-request-format-xml/111630/4 "2007-08-12T04:44:00Z")

</div>

On Aug 9, 7:29 am, Toby C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Sorry that wasn’t very clear.
> 
> I wan’t to move the unless request.format… into a before\_filter so I  
> don’t have to duplicate that unless…end in each method. How would I  
> do a ‘return’ for the entire request rather than just the current  
> method?

Make sure you also return false from your filter to abort further  
processing.

Otherwise, your filter will run, _and_ your action will run inducing  
another render, which isn’t allowed.

Jeff

> **[Hey Daddio!](http://softiesonrails.com)**
>
> Home of Hey Daddio Software

[essentialrails.com](http://essentialrails.com) - New to Rails? Get up to speed in 2 days. Sept  
21-22, 2007 in Chicago.

---

<div class="post-metadata">

**Author:** ![tobycatlin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5e9695/32.png) [@tobycatlin](https://www.ruby-forum.com/u/tobycatlin)\
**Post date:** [August 9, 2007, 2:29pm UTC](https://www.ruby-forum.com/t/unauthorised-unless-request-format-xml/111630/5 "2007-08-09T14:29:55Z")

</div>

Sorry that wasn’t very clear.

I wan’t to move the unless request.format… into a before\_filter so I  
don’t have to duplicate that unless…end in each method. How would I  
do a ‘return’ for the entire request rather than just the current  
method?

Thanks,  
Toby