Rails4 authorization strategies

Question

When it comes to Authorization/Authentication devise + cancan are usually my gems of choice. After the release of Rails4's strong parameters I've been looking into using the cancan_strong_parameters gem.

I can't shake the feeling that this approach seems a bit 'hacky'. The other options seems to be TheRole gem or simply rolling my own auth from scratch.

Was hoping anyone with first hand experience here could give a few pointers on how they tackled the problem, what problems the faced and where each approach fell short (if anywhere).

I know this isn't a clean cut StackOverflow typed question, but there doesn't seem to be much info regarding this subject when Googling. Thanks.

I think (not that I will write a better alternative but still) that this gem is just poorly written. One can make an assumption that strong params "filter" method will be `singular_model_params` and just call it in execution of CanCan (+ add an option to provide different method name) — Mike Szyndel, Jul 13 '13 at 13:52

score 4 · Accepted Answer · answered Jul 13 '13 at 18:36

4

Have you read the discussion in PR 763 "support for strong_parameters"?

In short, until cancan 2 comes out, some people are using Oliver Morgan's fork.

answered Jul 13 '13 at 18:36

Jared Beck

16,796
9
72
97

Thanks for that. Wasn't aware of Oliver Morgan's fork. I'm guessing the correct branch to use would be 'ollym_changes' right? – 8bithero Jul 20 '13 at 14:50

score 2 · Answer 2 · answered Feb 22 '14 at 22:49

2

There's also the protector gem:

https://github.com/inossidabile/protector

And cancancan:

https://github.com/bryanrite/cancancan

answered Feb 22 '14 at 22:49

Joshua Muheim

12,617
9
76
152

score 1 · Answer 3 · answered Nov 24 '13 at 23:18

1

Check out the_role gem which works in Rails 4 and is a CanCan replacement

answered Nov 24 '13 at 23:18

idrinkpabst

1,838
23
25

score 1 · Answer 4 · answered May 15 '14 at 13:19

I'd go with Cancancan based on:

It's based on Cancan, the most widely used Authorization Rails library (until Rails 4)
It's Rails 4 compatible
It has more Commits, Contributors and Releases on Github than other Rails 4 authorization gems (The_Role, Pundit, etc.)
It's has more downloads on rubygems.org than The_Role even though it has fewer downloads than Pundit

Rails4 authorization strategies

4 Answers4