Hello and welcome.
In this lecture we are going to implement some basic security.
So this is what our blog application looks like at the moment.
If we were to publish this blog online as it is anyone would be able to add to edit and delete post
or even delete the comments.
Luckily for us Real's provides a very simple.
T T T P authentication system that we allow was to prevent some security breaches.
So basically what we need to do we need to implement.
Inside are post controller.
We need to have a way to block access to the various actions.
If the person is not authenticators So one or implement some can security to certain view.
So we'll use the rails.
Here's TTP underscore basic authentication method which allows access to the requested action.
Even that method allows it.
So let's see how we implement that.
So let's open up our post control so that control does open up.
Post where we want implemented just after.
This application control I hear will Joe's tab down will add lead busy.
He's T T P authentication so this is how we do it.
Time being here.
T T.
P on the score basic.
On the score authentication.
Fenty came in on this call with.
Space.
Name.
They need to specify you name.
Right.
Or has a blue line.
So that's the person.
One of the people of the rights to access and we need to end password.
Password.
I'm going to enter is learning.
Next we need to do a comma and then.
Except I will explain what that means a minute.
Then he calls on.
Square brackets inside the square brackets would pass in some values and got pin links.
Comma space.
Call on.
Show.
So basically what this of fenty Kitchen here is saying is that we want the user to be authenticated
on every action.
Inside this controller except for the index and a shill.
So anyone visiting from our outside world apart from those have got authentication rights.
The only view they can see is the Index which is the home piece and the short page.
All right.
That's what that means.
Every other action within this controller there will need to enter their name and their password before
they can be authenticated to access the piece.
We want to do the same with the comments controller.
We don't want any one to be able to just delete comments so we need to click on the comments controller.
I said you need to do the same thing.
So all I need to do is just copy the authentication from the post and come here and just paste that
in and does change one or two things.
So basically what you want to specify inside big comments controls.
We only want authenticated users to be able to delete comments.
So again we said the password and we know when to use accept we are just going to replace the reward
except with only one time pain only we get rid of that because the only action we can sell about is
the destroy.
We do space call on this stroy this is the.
Action that's responsible for deleting the comments that were seen here or like those who have authentication
can delete any comment so you don't have authentication.
You will not be able to delete any comment I chilliwack can do we can wrap this around a square bracket
and is close that close and square bracket.
And we think that call on that insight.
Blue Square bracket.
And just to have FAS save all and dashes sorty so less tested to see if the authentication works.
So right click.
Okay we get it to refresh before we test.
I just wanna good true the code just I have everything right.
Oh.
I had to change this.
This was an 80 P on the core.
Busiek had it spelled authentication.
He should be authenticate So make sure you've got it exactly as I have it.
Now you may run into some problems.
This should be authenticate not authentication.
This is the post control like if I go to the Commons control like the same thing here.
He should be authenticate or gun and say that and let's test it.
Make sure the authentication works.
So now I'm going to go to the home.
I'm on tap someone to try and create reports took EFI having quote ventilation.
He will not let me.
So the only feed everyone can view is the home page and issue.
So if I click create I should get a prompt so I can see the basic authentication is working.
If I see a loggy he would tell me he has requested username on password to limit type my username mean.
Password.
And click logmein because he does log me now.
So now he's going to let me he paused.
How.
Just see.
Hello world.
Show me the money.
Then say put.
Excellence for gluten.
Wow.
I go home.
Let's scroll down to see the pause.
I have just added on.
That's the post I've just added.
I should be able to go to it and queing delete because I'm already logged in.
So excellent So the basic security is in place and he is working as designed.
So this is your busy security obviously for you going to publish on line in me to you know implement
here more robust security.
This is just a train in embarrassment.
So that's it.
This concludes this project so you can play around and also take it enhanced this projet wherever where
you like you can expand it.
You can add some more strobe more styling to make you look more pretty and you can create related projects
once you understand the concepts from Des projet.
You should have the skills to be more creative and develop similar projects.
So many thanks for watching.
Thank you so much for your time.
Throughout the course I have enjoyed doing it for you and I hope you benefit from it truly.
Take care and all the best wishes always.
Bye for now.