Agile Web Development with Rails 8

Iteration I3: Permitting Access

We want people without an administrative login to be able to purchase our products. This, too, can be accomplished with very little code.

We could go back and change things so that we mark only those methods that specifically need authorization. Such an approach, called denylisting, is prone to errors of omission. A much better approach is to allowlist—list methods or controllers for which authorization is not required. We do this by inserting an allow_unauthenticated_access call within the StoreController:

rails80/depot_r/app/controllers/store_controller.rb

class StoreController < ApplicationController
  allow_unauthenticated_access

And we do it again for the SessionsController class.

We’re not done yet; ...