Is it possible to have in a single Rails applications with cookie user sessions which are either domain or subdomain

Question

I want in a multi-subdomain application to login admins and simple users. The admins should have access to all the subdomains (i.e. their session should be stored in a cookie that is available to all the subdomains). The users should have access only to the subdomain which they logged in.

so for example:

admin "administrator" signs in either at the domain url (mydomain.com) or at any subdomain (e.g. abc.mydomain.com) and remains logged in all the subdomains. He ("administrator") can therefore access efg.mydomain.com, abc.mydomain.com, mydomain.com etc. etc.

user "simpleuser" signs in at abc.mydomain.com. He ("simpleuser") can only access this subdomain (i.e. the cookie relates only to the abc.mydomain.com subdomain)

I know that it is possible to choose to associate to cookie either to subdomain or the domain, but I would like to mix this behavior in the same application. Does anyone know of an approach?

This is for Rails 3

I would not want to limit access to the subdomain through my application ( i.e. through cancan or declarative authorization ). Ideally access should be blocked at the subdomain level through the cookie. I believe that this is a safer approach since it does away with having to set up one more piece of software for controlling access to the site.

Answer 1

You'll want to have the cookie valid across all subdomains, but use authorization to restrict users to give access to the subdomain.

Something like cancan could work here -- where if you are an admin, you can access everything, but a user can access only if you are that user.

in your application_controller

before_filter :authorize_me

def authorize_me
  @user = User.find_by_subdomain(request.subdomain)
  authorize! :administer, @user
end

In ability.rb class Ability include CanCan::Ability

  def initialize(user)
    user ||= User.new

    can :manage, :all if user.admin?

    can :administer, User do |new_user|
      new_user.id == user.id
    end
  end
end