# Using aspects to apply authentication

**URL:** <https://www.ruby-forum.com/t/using-aspects-to-apply-authentication/54336>\
**Category:** Rails\
**Created:** [March 1, 2006, 8:40pm UTC](https://www.ruby-forum.com/t/using-aspects-to-apply-authentication/54336 "2006-03-01T20:40:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cskidmore](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/bb73d2/32.png) [@cskidmore](https://www.ruby-forum.com/u/cskidmore)\
**Post date:** [March 1, 2006, 8:40pm UTC](https://www.ruby-forum.com/t/using-aspects-to-apply-authentication/54336/1 "2006-03-01T20:40:13Z")

</div>

Greeting. I was wondering if anyone is using AOP (Aspect Oriented  
Programming) to ensure login and authentication before allowing someone  
access to controllers and models.

I found two versions of RCR 321 that discuss cut-based AOP, but as far  
as I can tell there isn’t an implementation of the RCR as an AOP  
framework.

Additionally, I tried to dig up information on Aspect4r and AspectR.  
Aspect4r is a no-who. Aspect4 is out on SourceForge, but it doesn’t  
appear to be an active project.

The problem I want to solve is eleminating boiler-plate code from  
controllers and models that ensures a user is logged in and has rights  
to access a controller or model.

This has to be a problem others are confronting and have already solved.  
What approach is usually used? Does the Salt Login engine do this?

Does anyone use AOP?

---

<div class="post-metadata">

**Author:** ![cskidmore](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/bb73d2/32.png) [@cskidmore](https://www.ruby-forum.com/u/cskidmore)\
**Post date:** [March 1, 2006, 8:49pm UTC](https://www.ruby-forum.com/t/using-aspects-to-apply-authentication/54336/2 "2006-03-01T20:49:22Z")

</div>

Cody S. wrote:

“Aspect4r is a no-who.”

DOH! Make that “Aspect4r is a no-show” :o)

---

<div class="post-metadata">

**Author:** ![cskidmore](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/bb73d2/32.png) [@cskidmore](https://www.ruby-forum.com/u/cskidmore)\
**Post date:** [March 1, 2006, 10:02pm UTC](https://www.ruby-forum.com/t/using-aspects-to-apply-authentication/54336/3 "2006-03-01T22:02:49Z")

</div>

As I understand AOP, using :before\_filter to “drop in” user  
authentication is a classic case of AOP in action. This is a common  
approach to that specific task; it redirects your app to a block of  
code whenever a controller is accessed.

Similarly, using :after\_filter to “drop in” logging would be another  
case of following AOP practices in Rails. It’s probably not as common  
as before\_filter authentication, but I suspect a lot of people are  
implementing logging in this fashion.

Authentication and logging are the two classic use cases for AOP,  
although there’s obviously many others. However, I’d say support for  
AOP is built into Rails via :before\_filter and :after\_filter, is  
widely used, and there’s (possibly) no need to look at external  
AOP/Ruby libraries for many/most AOP-style requirements.

Does this answer your question?

Regards

Dave M.

---

<div class="post-metadata">

**Author:** ![cskidmore](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/bb73d2/32.png) [@cskidmore](https://www.ruby-forum.com/u/cskidmore)\
**Post date:** [March 1, 2006, 10:43pm UTC](https://www.ruby-forum.com/t/using-aspects-to-apply-authentication/54336/4 "2006-03-01T22:43:32Z")

</div>

Yes it does. That isn’t a lot of code to add to a controller for the  
functionality you get, and it just adds one more reason to love RoR.  
:o)