Access Denied: the missing guide to authorization in Rails
summary
Compares CanCan and Pundit, maps authorization models (DAC, MAC, RBAC, ABAC), and claims Rails lacks a built-in solution then demonstrates a new action_policy gem extracted from real projects and released as a pre-release at RailsConf. Measures reveal 45 policy checks on some pages (N+1 authorization), implements two-level caching and scope caching to save hundreds of milliseconds per request, provides a test mode that tracks policy calls and reduces controller tests, and supports namespaces, failure reasons, and multi-context policies.
AI-written summary · about
chapters (24)
- 0:00Start
- 4:16AUTHENTICATION
- 5:19EXAMPLE
- 7:37DISCRETIONARY (DAC)
- 8:41MANDATORY (MAC)
- 10:06ATTRIBUTE-BASED
- 12:26IN RAILS
- 14:04TOOLS
- 14:22WHAT PEOPLE SAY
- 17:09THE EVOLUTION
- 18:10WHY CUSTOMIZE?
- 19:45THE QUESTION
- 21:50Let's talk about
- 22:01BOILERPLATE
- 25:38PERFORMANCE
- 26:24ActiveSupport :: Notifications
- 26:51N+1 AUTHORIZATION
- 28:06CACHE STORE
- 31:23CASE: TESTING CONTROLLERS
- 32:07ACTION POLICY
- 33:53SCOPES
- 35:27NAMESPACES
- 38:31MORE FEATURES
- 39:40CONTEXTS
related talks
27mAuthorization in the GraphQL era
09mFlexible Authorization:Storing and Managing Rules in DB
26mAuthorization in a Service-Oriented Environment
01h 07mGetting Authorization Right in .NET: Patterns, Pitfalls...
42mBeyond Code: Shaping Security in a Developer-Driven World
38m"Application Security for Rails Engineers"
25mModernizing Authorization: From Basic Roles to Decoupled ABAC
45mThe Future of Authorization in Applications