Secure active storage with devise

Question

Using devise gem to authenticate all users of an application. I'm trying to implement Active Storage.

Let's say that all users must be authenticated as soon as they reach the app:

class ApplicationController < ActionController::Base
  before_action :authenticate_user!

...
end

How to secure the Active Storage generated routes?

URL of an uploaded file can be accessed without having to authenticate first. The unauthenticated user can get the file url generated by Active Storage.

Answer 1

If you want to implement authentication for all endpoints provided by active storage, you can override the ActiveStorage::BaseController based on the original implementation:

# app/controllers/active_storage/base_controller.rb

# frozen_string_literal: true

# The base class for all Active Storage controllers.
class ActiveStorage::BaseController < ActionController::Base
  before_action :authenticate_user!
  include ActiveStorage::SetCurrent

  protect_from_forgery with: :exception
end