Question

I think the answer is an admin login and then check if the user has an admin flag, but I also thought of some other related questions.

Is it better to have an admin flag (attr_protected) in the same user table as non admins? or should i have an admin users table?

Should I create a separate rails application for the admin users? This might be overkill since they will both have to access the same datbase (not to mention it might be a huge pain to set up).

Any other suggestions? Right now I just need to secure a page or two so I even looked into HTTP basic or digest authentication as a temporary measure (the protected content is actually not THAT private/important). But… I don’t know how to implement HTTP auth for specific actions, I have only seen how to implement it to prevent directory access.

Any direction and discussion would be great. I am sure other Stack Overflow users will benefit from this discussion.

Thanks!

Answer 1

Ryan Bates has a great three part series of Railscasts on this topic which should give you some food for thought:

• Part 1: Where Administration Goes
• Part 2: Restricting Access
• Part 3: Super Simple Authentication

There are also three Railscasts on different authentication techniques:

• RESTful Authentication
• HTTP Basic Authentication
• Authlogic