在Heroku上管理宝石

Question

I have followed a tutorial on how to install The Administrate Gem which is an alternative for ActiveAdmin in Ruby on Rails , It's working fine in development and production (Heroku) but the only concern is when i go to www.myherokuapp.com/admin i go there without asking for a password. I even did that with another computer. Did anyone had this issue before ? Here's my user dashboar file

dashboard/users_dashboard

require "administrate/base_dashboard"

class UserDashboard < Administrate::BaseDashboard
  # ATTRIBUTE_TYPES
  # a hash that describes the type of each of the model's fields.
  #
  # Each different type represents an Administrate::Field object,
  # which determines how the attribute is displayed
  # on pages throughout the dashboard.
  ATTRIBUTE_TYPES = {
    posts: Field::HasMany,
    reviews: Field::HasMany,
    id: Field::Number,
    email: Field::String,
    encrypted_password: Field::String,
    reset_password_token: Field::String,
    reset_password_sent_at: Field::DateTime,
    remember_created_at: Field::DateTime,
    sign_in_count: Field::Number,
    current_sign_in_at: Field::DateTime,
    last_sign_in_at: Field::DateTime,
    current_sign_in_ip: Field::String,
    last_sign_in_ip: Field::String,
    created_at: Field::DateTime,
    updated_at: Field::DateTime,
    name: Field::String,
    password: PasswordField,
    password_confirmation: PasswordField

  }

  # COLLECTION_ATTRIBUTES
  # an array of attributes that will be displayed on the model's index page.
  #
  # By default, it's limited to four items to reduce clutter on index pages.
  # Feel free to add, remove, or rearrange items.
  COLLECTION_ATTRIBUTES = [
    :posts,
    :reviews,
    :id,
    :email,
  ]

  # SHOW_PAGE_ATTRIBUTES
  # an array of attributes that will be displayed on the model's show page.
  SHOW_PAGE_ATTRIBUTES = ATTRIBUTE_TYPES.keys

  # FORM_ATTRIBUTES
  # an array of attributes that will be displayed
  # on the model's form (`new` and `edit`) pages.
  FORM_ATTRIBUTES = [
    :posts,
    :reviews,
    :email,
    :password,
    :password_confirmation,
    # :encrypted_password,
    # :reset_password_token,
    # :reset_password_sent_at,
    # :remember_created_at,
    # :sign_in_count,
    # :current_sign_in_at,
    # :last_sign_in_at,
    :current_sign_in_ip,
    :last_sign_in_ip,
    :name,
  ]

  # Overwrite this method to customize how users are displayed
  # across all pages of the admin dashboard.
  #
  # def display_resource(user)
  #   "User ##{user.id}"
  # end
end

Answer 1

As suggested by the authors , the easiest way to secure your admin page is basic HTTP authentication:

class Admin::ApplicationController < Administrate::ApplicationController
   http_basic_authenticate_with name: "name", password: "supersecretpassword"
end

Make sure you don't put your name and password in your source if it's public. Use environment vars (using dotenv below) instead:

class Admin::ApplicationController < Administrate::ApplicationController
  http_basic_authenticate_with name: ENV.fetch("ADMIN_NAME"), password: ENV.fetch("ADMIN_PASSWORD")
end

Answer 2

In your Admin::ApplicationController you should implement the authenticate_admin method. So for example you could redirect your user if they're not an admin. For more info, you can check the docs .

def authenticate_admin
 redirect_to root_path unless current_user.admin?
end