Question

So Devise has what seems to be two methods of accomplishing the same thing, firstly it seems the classic way of protecting a unauthorized user from accessing a controllers action would be something like this in my controller:

before_filter :authenticate_user!

But I’ve been seeing this done in the routes.rb more often now also like so:

authenticate :user do
  resources :reports
end

Which one should I be using?

Answer 1

That logic belongs to the controller, not routes. Routes are just what they are, routes. It’s not good to put some logic into them.