Skipping authorization for certain methods

Question

Per the Agile Development book, I have an Admin MVC that controls how users log in. In ApplicationController, I have a before_filter that checks for authorization. So, this will check that the user has logged in for every page.

The problem is that I want everyone to be able to access the new method, for example, in Users (that is, anyone should be able to create a new user -- naturally! Only admin users should have access to the other methods in UsersController such as edit, etc.). What's the best way to do that?

Answer 1

You can either of this

before_filter :except=>[:method_name]  #methods you want to skip filter

OR

before_filter :only=>[:method_name]    #methods you want to be filtered before called.

EDITED

before_filter :filter_method, :except=>[:method_name]  #methods you want to skip filter

OR

before_filter :filter_method, :only=>[:method_name]    #methods you want to be filtered before called.

Answer 2

I would also suggest using CanCan gem for authorization as it has a really simple and clean way to define authorization rules. http://github.com/ryanb/cancan