Layered Design for Ruby on Rails Applications

9

Authorization Models and Layers

Authorization is a crucial security aspect and, thus, it’s important for any web application. This chapter explores the concept of authorization in Ruby on Rails applications. First, we will discuss the role and place of authorization in an application’s security.

Then, we’ll introduce the two fundamental concepts of authorization: the authorization model and the authorization layer. Finally, we’ll discuss the problem of authorization enforcement and how it relates to an application’s performance.

This chapter touches on an important topic of application security. The robustness of its implementation is doubly important. Every user action must be authorized, and every input verified. You can achieve such a level ...