CODEWITHSUNDEEP
ruby-on-railsruby
yamaoka
yamaoka

Reputation: 131

How do you restrict access to a certain webpage?

I am trying to allow access to the log-in/sign-up page for a admin user only from my computer or any other way that lets me only see the web page for an admin sing-up-log-in.

Or what do typical web applications do to restrict access to the public towards a certain web page? If there is a bets-practice way, I would like to implement that.

I currently have Devise installed.

Upvotes: 1

Views: 1539

Answers (2)

Saurav Prakash
Saurav Prakash

Reputation: 1247

I normally restrict webpage access through controller methods. My recent use case was going to a webpage only when payment was successful but redirecting when it was not, if any body issued a get request for that page directly, it would result in 404.

In your case, there can be multiple option for setup.

  1. You can use cookies to see users credentials using Action Dispatcher
  2. Use Devise for users and then you can fix a certain role to a user through adding a new migration and assign roles yourself after registering or let them choose.

I will expect you followed Devise route. In the controller action check for current user's role. 

If User Not signed in (using current_user == nil)
  redirect to home page and then return

else
  if 
    its admin you go ahead and use the success page as partial and let them see the page using `<%= render 'pages/mypage'%>` and use return to end
  else 
    just redirect back to home page with a notice "Don't try this". 
    redirect_to root_path, notice: 'Don't try this' and then use 
    return to end
end

(Just for fun, to see how many times a user did this wrong action, you can also have a table which stores current_user and number_of_wrong_attempt, and store their email whenever they try to go that page without permission before redirect in controller. After that you can email them with a background rake task which checks for a certain false attempt threshold that: "Hey! Your registration is being removed because you are doing unprohibited actions")

Upvotes: 1

Sebasti&#225;n Palma
Sebasti&#225;n Palma

Reputation: 33491

You can use the authenticate_user! Devise helper, adding it as callback within the needed controller and specifying the methods you want to control.

For instance if you have a Post model, then adding the authenticate_user! in the PostController it'll ask the user to be logged to have access to the methods in that specific controller:

class PostsController < ApplicationController
   before_action :authenticate_user!

If you want to restrict just some specific methods then you can play with only and/or except.

See: Devise will create some helpers to use inside your controllers and views. To set up a controller with user authentication, just add this before_action (assuming your devise model is 'User')

Devise - Controller filters and helpers

According to your comment then you can create a method in the ApplicationController in order to restrict all of your controllers and methods.

This way you can define an array of addresses, and if the remote_ip coming from the request is in the array then you give access, if isn't then perform any other action:

ApplicationController < ActionController::Base
  before_action :protect

  private

  def protect
    addresses = ['127.0.0.1', ...]
    if addresses.include?(request.remote_ip)
      # give access
    else
      # restrict access
    end
  end
end

But if you need something more sophisticated then you'd have to see on your Nginx or Apache, whatever you're using to deploy your project.

Upvotes: 3

Related Questions