9

I am using rails 4, devise for authentication and Pundit for authorization. I have restricted my application to check for authorization on every controller by below code. 

class ApplicationController < ActionController::Base
  include Pundit
  after_action :verify_authorized
  #.....
end

However, i want to skip authorization for two specific controllers in my application (they are open to public, users do not need to sign in). How can i achieve it without removing verify_authorized in ApplicationController ?

Vijay Meena
  • 683
  • 1
  • 7
  • 12

2 Answers2

19

skip_after_action :verify_authorized

devkaoru
  • 1,142
  • 9
  • 7
8

I'm working with Rails 5 and I wanted to skip authorization in just one action but not the whole controller. So, what you can do according to the documentation is to use skip_authorization feature in the controller action as shown below:

class Admin::DashboardController < Admin::BaseController
    def index
        @organizers = Organizer.count
        @sponsors = Sponsor.count
        @brochures = Brochure.count

        skip_authorization
    end

    def sponsors_approve
        # some statements...
    end

    def organizers_approve
        # some statements...
    end
end

In this controller the only one action to be skipped is index, the other ones must be authorized.

I hope it could be useful for somebody else.

alexventuraio
  • 8,126
  • 2
  • 30
  • 35
  • 1
    Better use `before_action :skip_authorization, only: :index`, this way it's clear what you're doing and you don't have to copy anything if you decide you wanna do this in any other action as well – Andrew Rozhenko Feb 10 '20 at 11:28