Is there a way to filter unsupported formats in the routes file?

Question

I have a Rails app that's getting hit by ScanAlert calling /login.php, but the app is throwing a 500. I'd like to filter any format that's not supported by my site, and 404 instead.

My original inclination was to create a before_filter in application_controller.rb that removes any :format that's not :html, :xml, or :js, then render 404.

However, it would be better to catch unsupported formats at the routing level. Has anyone approached it this way and what did you put in the routes file?

It would seem that this would be a common problem, yet I wasn't able to find any solutions.

Answer 1

Just mapping the route to a none existent action should return a 404.

Try adding this to your routes.rb:

map.connect '/login.php', :controller => 'application', :action => 'devnull'

For a more general solution, add this to the end of all routes (doing so neatly is an exercise for the reader (hint: with_options)):

:conditions => {:format => /js|html|xml/}

or from the other side:

map.connect '/*whocares.php', :controller => 'application', :action => 'devnull'

Answer 2

If it is the same URL over and over it might be worth adding an Apache rewrite rule on your production server to map the URL to your 404 page so it never touches Ruby. Apache rewrite guide

Answer 3

If you are using restful routes you should be about to use

respond_to do |format|
  format.html 
end

this will return a 401 (i think) which is not an error which would appear in your logs, but instead an 'unrecognized format' (although I could be wrong on the exact code and message). Either way, it doesn't require special config in your routes or in your apache setup, and instead uses convention over configuration.

If your routes are not restful then you should be able to add a :format at the end of the route to make it work, eg.

map.login '/login.:format', :controller => 'application', :action => 'login'

Also, a quick note, try not to use map.connect, instead use named routes as they are cleaner and convey meaning by expressing what the route is actually doing, especially in your views. (login_path says a lot more and is cleaner than its cousin { :controller => 'application', :action => 'login' } )

Hope this helps.