tags:

views:

42

answers:

1
Q: 

Devise and swfupload authorization

i'm trying to verify in my controller whether user has sufficient rights to upload files or not. swfupload does a POST request with (according to documentation) cookie values passed directly in POST request. this makes before_filter :authenticate_user! unusable, user is not authorized correctly.

as far as I know from devise docs, there is a possibility of creating custom session controllers. is it a good starting point to solve this problem? any idea how to extract session id from POST and proceed with authorization?

A: 

I had a similiar issue with swfupload. I used midleware and some custom helper links to make it work. More info here: http://thewebfellas.com/blog/2008/12/22/flash-uploaders-rails-cookie-based-sessions-and-csrf-rack-middleware-to-the-rescue

ebuychance  2010-09-28 11:28:15
yup, thanks. this is exactly what I needed. just one more tip for other people. be aware of the position of your middleware in stack. middleware presented in link above should be called as early as possible (before Warden). so instead of `config.middleware.use` use better `config.middleware.insert_before`
Michal  2010-10-03 20:57:33
one more comment. it's even simpler to use POST params instead of custom links. if you use swfupload, pass your session id in `post_params` parameter (see swfupload docs) and extract it in your middleware using `params = ::Rack::Request.new(env).params`
Michal  2010-10-03 21:00:26

related questions

Is there a rake task for backing up the data in your database?
How to represent cross-model information in MVC?
WYSIWYG editor gem for Rails?
Best Solution For Authentication in Ruby on Rails
Acts-as-readable Rails plugin Issue
Associating source and search keywords with account creation
Any tips on getting Rails to run with an Access back-end?
Being as DRY as possible in a Ruby on Rails App
How Do You Secure database.yml?
What IDE to use for developing in Ruby on Rails on windows?
Is Ruby On Rails ready for the Enterprise?
OpenID authentication in Ruby on Rails
Why Doesn't My Cron Job Work Properly?
Why does sqlite3-ruby-1.2.2 not work on OS X?
Ruby mixins and calling super methods
Why all the Active Record hate?
Haml: how do I set a dymanic class value?
Learning Ruby on Rails any good for Grails?
How to sell Python to a client/boss/person with lots of cash
How do I create a new Ruby on Rails application using MySQL instead of SQLite?
Ruby On Rails with Windows Vista - Best Setup?
What is good forum software to add to an existing Rails application?
How do I fix 'Unprocessed view path found' error with ExceptionNotifier plugin in rails 2.1?
Frequent SystemExit in Ruby when making HTTP calls
Implementation of "Remember me" in a Rails application.