Question

In Ruby on Rails, is there a standard way of restricting certain methods in the controller to users who have logged in, or users with specific rights? Let’s say for simplicity’s sake I have a blog, and I want everyone to be able to access the “list” and “show” methods in my controller, but I only want logged in users to access the “edit”,”update”,”create” and other methods. Do I have to program the logic, or at least a function call into each one of these functions to check for user access rights, or is there a more formal way?

Answer 1

You can use a before_filter.

Class blogController
before_filter :authorize, :except => [:list, :show]

def authorize
    #Your code to get a logged in user
    redirect_to blog_path unless user
end