Yours.
Welcome back to this tutorial.
Today we'll be looking at how we can global restricting access to certain parts of our sites.
No.
Up until this point I'm sure you understand that a controller LITERALLY CONTROLS THE ENTIRE sides.
It controls the flow of things.
Anything that you request to view which will render what we call literally a view is going to be searched
for and later rendered by our controller server quest.
With passed through the controller and it will leave the results.
Well we want to look at today is restricting what somebody can or cannot see.
All right.
So today we'll be using this course as controller as our guinea pig as it were.
And then we will dissect what we can put in to control who can see what.
No the first thing that I want to point out is a new data on notation that you have seen in the current
controller called authorize the authorize means that you cannot access anything inside this controller
unless you are authorized or by extension authenticated authenticated meaning you have signed into the
application and you are identified as an authorized person.
In short if I want to restrict everything inside of my courses controller meaning you can't view the
list of course as you can view the detail of any course you can create of course and you can edit or
do any of these operations in addition to whatever else you may have added to the controller.
Then I need only right above the controller declaration right.
Open square brackets and the word authorize and again always hover over it and see that it says it specifies
that a controller or action is restricted to only people who needs the authorization requirements.
And in this case you have to be logged in to be counted as authorized.
So if we do this and then we run and then attempt to browse to anything inside of the controller for
courses then we should be redirected to the log in page.
I will try that now in our last video we did test the registration and log in features that we saw that
they work and we just specify that courses should require some amount of authorization before it grants
access which means that this one which should lead to courses should restrict me from proceeding and
let's put that to the test.
So click learn more and then voila.
I am not required to log in.
And then if I see a log in using that existing user information then I will be redirected to the causes
index speech.
I can go back home and for the entire duration that I am logged in I can click learn more and go ahead
without any hindrance.
All right.
And then once I'm here remember that the authorize was over the entire controller.
So once I'm authorized I can now edit and delete and view details and do all of the wonderful things
that I would be allowed to do as an authorized person.
Now I'm just going to log off and then we'll continue with our experiments and you see that having logged
off it's moved me automatically from the restricted page mark to a page that it doesn't really care
if I access are not.
So for our students controller we also want to authorize because we don't want every and anybody to
be able to just get into the system and view and delete and edit etc. But then I want to lift the restriction
on the view for the student listing so everything is requires authorization.
But I want this particular action maybe some others also but in this situation this particular one to
be able to be viewed without having the proper authorization.
So there is another attributes called a low Anonymous which if you read the tooltip kind of overrides
the authorized attributes or authorize attributes is global.
It's the Overlord colorful control that has the answer to it but then anywhere that has a low anonymous
kind of says Okay I would make an exception for this one.
You don't have to be authorized for that one.
All right.
So you can add that to index.
I want to restrict the creation of students and editing of a student and deletion of a student by a
non registered user.
So leave those alone and then we can see if that work all right.
So we're not logged in and then we want to go over and view all students.
So I go to all students and then we see wow it loads I'm still not logged in and I'm able to browse
all students.
However when I try to create new edit or view details and I open all of these in different up so we
can see the different results.
You see this this is create it's requiring me to log in.
This one is edit it's requiring me to log in and this one was for details.
It's requiring me to log in so you see although we authorized the entire controller we can allow anonymous
access to particular views that you know if the person is not logged in Okay fine finally we let you
see the information but to get any further we need you to be authorized.
You can also add this authorized the part to kill or use if it is a case where you have the controller
and you want all of it to be open to everybody but for one or two views you can just add that authorize
attributes directly to that action in your controller.
So instead of allowing anonymous you would authorize right here above that action which would then restrict
that actions.
Accessibility.
So I hope you guys phone value in this video.
The next video we'll talk of bullets restricting it based on rules and modifying what options are available
on the view when the person is authorized as opposed to when they're not authorized or when they are
a particular rule versus when they're not.
All right.
So thanks for viewing and see you next time.