Question

I want to completely lock down a Rails application, such that all routes which are not explicitly authorized for a particular user role are rejected (403).

I inherited this app, so my understanding of the framework is poor, but it currently seems like I have opposite: everything’s open unless I explicitly close it.

I have an authorization_rules.rb file, and I’ve given the guest role no permissions, yet I can still access pages without being logged in. I think I can go in page by page and make sure a page requires authorization (filter_access_to ?), but I might miss one. How can I just shut everything down, then open access only where I explicitly allow it?

This is using Rails 2.3.5.

Answer 1

Assuming the app uses before_filter to restrict access, you can move the before filter in application controller and skip it for particular actions in individual controllers:

#app/controllers/application_controller.rb
before_filter :filter_access

#app/controllers/your_specific_controller.rb
skip_before_filter :filter_access, :only => [:action1_accessible_by_guest, :action2_accessible_by_guest]