Password protecting pages simply with rails - what should I do?

Question

I'm now on level 7 of Hartl's rails tutorial book and I'm starting to think about my application in deployment. It's an app that allows about 12 social workers to communicate collaboratively and privately. Thus, I need to password protect it.

However, it also needs to be easy to use, very easy to use. A few of these people haven't used a computer before, and having logging on and sign-up processes would put them off completely.

Thus I want to create a landing page, where they have to type a password in (the same password for everybody), then it redirects to the 'discussion pages.' My first idea was to use some obfuscated javascript such that upon typing in the password, it redirects them to the discussion pages, but this doesn't sound very secure.

Can anyone recommend me a better way to do this in rails? Ideally they would only have to type it in once, and then it would authenticate them for all the pages automatically (by setting a cookie?) and anyone trying to access a page directly would be redirected to the authentication page.

Cheers in advance

Hypercorrect

Have a go on this gem github.com/plataformatec/devise it will help you in authentication, session and all your requirements. – Pipage

If you are building your first Rails application, we recommend you to not use Devise. Devise requires a good understanding of the Rails Framework. Sounds like using a sledgehammer to crack a nut. It's a whole new MVC – Hypercorrect

We didn't face any issues while using devise, its your wish. – Pipage

Answer 1

A very simple authentication option is available to you in this situation. I would suggest you watch the Ruby on Railscast episode 270. I think it just maybe what you are looking for.

Probable

Answer 2

If you want really simple, you can use authenticate_or_request_with_http_basic

It's not a replacement for a real authentication system, e.g. Devise or AuthLogic however.

Tirado

Answer 3

I started to use the lockup gem for this purpose: https://github.com/gblakeman/lockup

It is super easy to setup and almost every user accessing the site should be able to use it.

Vitia

I second the use of the lockup gem... Super clean way to protect a site that's under development! – Giraffe

Answer 4

I wanted to check the right employee was editing their profile.

I have the models Employer, Employee, Employee Invitations.

The employer would send an employee invitation out (name, email, employee_number) to an employee which would create the employee and update the same fields.

Fire an email to the employee with a link to edit_employee inside.

Employee would click on the link taking them to a form for the employee_number_check.

If they submit the correct employee number then it would refresh the page and display the contents after this if statement.

<% if @employee.employee_number == @employee.employee_number_check %> 

Hidden Content

<% end %> 

Humiliating

Adding the definitions of the models in code might make your answer more useful. – Microhenry