Skipping authorization for certain methods

Question

Per the Agile Development book, I have an Admin MVC that controls how users log in. In ApplicationController, I have a before_filter that checks for authorization. So, this will check that the user has logged in for every page.

The problem is that I want everyone to be able to access the new method, for example, in Users (that is, anyone should be able to create a new user -- naturally! Only admin users should have access to the other methods in UsersController such as edit, etc.). What's the best way to do that?

Answer 1

You can either of this

before_filter :except=>[:method_name]  #methods you want to skip filter

OR

before_filter :only=>[:method_name]    #methods you want to be filtered before called.

EDITED

before_filter :filter_method, :except=>[:method_name]  #methods you want to skip filter

OR

before_filter :filter_method, :only=>[:method_name]    #methods you want to be filtered before called.

Answer 2

You can use the skip_before_filter method in child controller classes to skip the default filter processing. For example:

class UsersController < ApplicationController
  skip_before_filter :authorize, :only => [:new, :create]
end

—Will skip the before filter named :authorize only for the new and create actions within the users controller i.e. the filter will still get applied for all other actions.