HTTP Basic Auth for some (not all) controllers

Question

Using Rails 3.2.

I have half a dozen controllers, and want to protect some (but not all) of them with http_basic_authenticate_with.

<

Answer 1

Do it the way Rails does it.

# rails/actionpack/lib/action_controller/metal/http_authentication.rb

def http_basic_authenticate_with(options = {})
  before_action(options.except(:name, :password, :realm)) do
    authenticate_or_request_with_http_basic(options[:realm] || "Application") do |name, password|
      name == options[:name] && password == options[:password]
    end
  end
end

All that http_basic_authenticate_with does is add a before_action. You can just as easily do the same yourself:

# application_controller.rb

before_action :http_basic_authenticate

def http_basic_authenticate
  authenticate_or_request_with_http_basic do |name, password|
    name == 'xxx' && password == 'yyy'
  end
end

which means you can use skip_before_action in controllers where this behavior isn't desired:

# unprotected_controller.rb

skip_before_action :http_basic_authenticate