Question

How do I prevent users from calling a method “doAction” in my controller using GET requests? I only want it to be called using POST requests?

I heard I need to use “verify” but I’m unsure where to put that code, or how I need to use it.

Answer 1

You can specify which methods are allowed for any action in your routes.rb.

Rails 2:

map.connect '/posts/doAction', :controller => 'posts,
                               :action     => 'doAction',
                               :conditions => { :method => :post }

Rails 3:

match 'posts/doAction' => "posts#doAction', :via => :post

post 'posts/doAction', :to => "posts#doAction'