ruby on rails - Do actions that are not defined in the controller need authorization such as before_action nevertheless? -

my userscontroller not have actions destroy, index , show defined, won't needed. i'll delete users out of database , users page or user index page won't available in application.

however, necessary secure actions nonetheless filter such before_action :correct_user provide maximum security or there no way potential attacker somehow manipulate actions in order view or destroy users?

besides that, create , new action of postscontroller need protected filter well? read: possible people time on hands create posts id of other users?

also, ways make sure actions bulletproof? using tdd -- alternatives?

i rather new authorization , security – there resources on topic? books, articles, screencasts do.

you can restrict resource routes actions not available.

full details available in routing guide: http://guides.rubyonrails.org/routing.html#restricting-the-routes-created

something it:

resources :users, except: [:index, :show, :destroy]