用于Devise身份验证的cancan skip_authorization_check

Question

因为任何人都可以注册然后登录,并且因为在登录之前没有为角色识别用户,所以跳过author_check for Devise是否有意义？

继续这个前提,我使用这个registrations_controller从Devise注册控制器继承并将其放在控制器目录中.

class Users::RegistrationsController < Devise::RegistrationsController
  skip_authorization_check
end

切换到路线文件:

devise_for :users, :controllers => { :registrations => "registrations" }

我错过了一些东西:

This action failed the check_authorization because it does not authorize_resource. Add skip_authorization_check to bypass this check.

谢谢你的帮助.

Answer 1

简单的解决方案

check_authorization :unless => :devise_controller?

如果您必须在某个时刻手动将check_authorization放在每个控制器中,您将忘记并在应用程序中打开一个安全漏洞.最好通过cancan明确地将不需要auth的控制器列入白名单.

这在CANCAN文档中已经明确了

https://github.com/ryanb/cancan/wiki/Ensure-Authorization

编辑

class ApplicationController < ActionController::Base
  check_authorization :unless => :do_not_check_authorization?
  private
  def do_not_check_authorization?
    respond_to?(:devise_controller?) or
    condition_one? or
    condition_two?
  end

  def condition_one?
   ...
  end

  def condition_two?
   ...
  end
end