Ruby on Rails Devise Adding Admin

Question

I am trying to create a site that has 1 Admin and many users. The Admin has control over all of the users.

I am using:
- Rails 4.0
- Devise 3.2
- Sqlite3

I have generated a user model and followed instructions for adding an attribute to the user model using option 2. https://github.com/plataformatec/devise/wiki/How-To:-Add-an-Admin-role

In the database it sets a boolean value for admin to false. Is it secure to allow admin control from the database?

I am curious because the password is not stored in the database, but instead an encrypted string is stored.

Is there another way to create an admin? I attempted to follow option 1 but it has given me a lot of trouble.

You state 'I am curious because the password is not stored in the database, but instead an encrypted string is stored.' Why do you think an encrypted string is less secure than a clear text password? It is very bad practice to store clear text passwords anywhere. — Steve Wilhelm
yes I understand why you shouldn't store clear text passwords. Sorry if I was unclear - I believe an encrypted string is more secure. Since we don't store text passwords, why do we store the option to gain access to the entire site in the database? — Daniel
Option 1 also stores access to the entire site in the database, just in a different table. If you don't store admin credentials in the database, where would you store it that you feel would be more secure? In practice, I wouldn't recommend sqlite3. Since you are using Heroku, I would recommend PostgresSQL instead. — Steve Wilhelm
I'm not sure. Could it be in a method? My thought is the method would describe the first user to sign up == admin. That would never have an admin attribute in the database. What is the main difference with using Postgres? — Daniel

Daniel Daniel · Accepted Answer · 2013-11-18T05:33:35

I found the question has already been asked in a different way

Option 1 is more secure and with option 2 anyone can add a parameter saying admin=true.