Why authentication secures applications in Ruby on Rails - Challenge Your Understanding

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user tries to access a protected page without logging in?

Consider a Rails app with a before_action that requires authentication for certain pages. What will the user see if they try to visit a protected page without being logged in?

Ruby on Rails

class DashboardController < ApplicationController
  before_action :authenticate_user!

  def index
    render plain: "Welcome to your dashboard"
  end
end

A The user gets a 404 Not Found error.

B The user is redirected to the login page before seeing the dashboard.

C The user sees the dashboard content but with limited features.

D The user sees a blank page with no content.

💡 Hint

Think about what authenticate_user! does before the action runs.

The authenticate_user! method checks if the user is logged in. If not, it redirects them to the login page. This prevents unauthorized access to protected pages.

❓ state_output

intermediate

What is the value of current_user after a successful login?

In a Rails app using Devise, after a user logs in successfully, what does the helper method current_user return?

Ruby on Rails

user = User.create(email: "[e-mail]", password: "password")
# After logging in with these credentials
current_user

A An instance of the User model representing the logged-in user.

B nil, because current_user is only set during signup.

C A boolean true indicating the user is logged in.

D An error because current_user is undefined.

💡 Hint

current_user is a helper method provided by Devise.

After login, current_user returns the User object for the logged-in user. This lets the app know who is using it.

📝 Syntax

advanced

Which code snippet correctly restricts access to admin users only?

You want to allow only admin users to access the admin dashboard. Which before_action code correctly enforces this?

A

before_action :authenticate_user!, only: [:admin]
if !current_user.admin?
  redirect_to root_path
end

B

before_action :authenticate_user!, only: [:admin]
redirect_to root_path unless current_user.admin?

C

before_action :authenticate_user!, only: [:admin]
before_action :check_admin, only: [:admin]

def check_admin
  redirect_to root_path unless current_user.admin?
end

D

before_action :authenticate_user!, only: [:admin]
return redirect_to root_path unless current_user.admin?

💡 Hint

Think about where to put the admin check and how to use before_action properly.

Option C uses a separate method check_admin called by before_action. It redirects non-admin users safely before the action runs.

🔧 Debug

advanced

Why does this authentication code raise an error?

This code is meant to authenticate users but raises an error. What is the cause?

Ruby on Rails

class ApplicationController < ActionController::Base
  before_action :authenticate_user

  def authenticate_user
    unless current_user
      redirect_to login_path
      return
    end
  end
end

A before_action should call :authenticate_user! instead of :authenticate_user.

B The method name should be authenticate_user! with an exclamation mark.

C current_user is not defined in ApplicationController.

D redirect_to must be followed by return to stop execution.

💡 Hint

Think about what happens after redirect_to is called.

Without return, the action continues running after redirect_to, which can cause errors or unexpected behavior.

🧠 Conceptual

expert

Why is authentication critical for application security?

Which statement best explains why authentication is essential to secure a web application?

A It verifies the identity of users to prevent unauthorized access to sensitive data and actions.

B It encrypts all data sent between the user and server to protect privacy.

C It automatically fixes security bugs in the application code.

D It speeds up the application by caching user sessions.

💡 Hint

Think about what authentication does before allowing access.

Authentication confirms who the user is. This stops strangers from accessing private parts of the app, protecting data and functionality.