What is the best way to securely add administrative access to my rails website?

Question

I think the answer is an admin login and then check if the user has an admin flag, but I also thought of some other related questions.

Is it better to have an admin flag (attr_protected) in the same user table as non admins? or should i have an admin users table?

Should I create a separate rails application for the admin users? This might be overkill since they will both have to access the same datbase (not to mention it might be a huge pain to set up).

Any other suggestions? Right now I just need to secure a page or two so I even looked into HTTP basic or digest authentication as a temporary measure (the protected content is actually not THAT private/important). But... I don't know how to implement HTTP auth for specific actions, I have only seen how to implement it to prevent directory access.

Any direction and discussion would be great. I am sure other Stack Overflow users will benefit from this discussion.

Thanks!

Answer 1

Ryan Bates has a great three part series of Railscasts on this topic which should give you some food for thought:

• Part 1: Where Administration Goes
• Part 2: Restricting Access
• Part 3: Super Simple Authentication

There are also three Railscasts on different authentication techniques:

• RESTful Authentication
• HTTP Basic Authentication
• Authlogic

Answer 2

I'm using restful_authentication plugin for this purpose. And it is very simple to restrict access to any controller or any method. On example in controller add this function:

private
def authorized?
  user.admin?
end

or

private
def authorized?
  user.admin? if update? || create?
end

I defined admin? method in my User model. I also created update? and create? methods that check which action was called. In restful_authentication authorized? method is always run when accessing controller.

I would put everything in one application and in one table (don't create users and admin table). You can secure admin flag in your users controller by allowing to set this value only for existing admin users.