Filters/Callbacks should be in concerns or not

Question

Let's say I have a concern in controllers and it's name is Authentication. It contains a before_action method authenticate_user. Where should I write before_action :authenticate_user? what is the best practice? Is it should be written in concern or in the controller in which this concern is included?

NOTE: I want to implement single responsibility

Answer 1

It depends on your controller structure. Auth logic is most commonly placed in a higher-level controller that most other controllers ultimately inherit from, rather than a concern. This is because you can simply enable auth at a higher level and have it be active on all subcontrollers without the need to add a concern explicitly for each of them, which might be more error prone. That higher-level controller would contain both the before_action and the authenticate_user method. If for any reason, there's a controller along the way which needs auth disabled, assuming this would be an exception, you could use skip_before_action.

class UserController < ApplicationController
    before_action :authenticate

    private

    def authenticate
        # ...
    end
end

class SomeController < UserController
    # auth already enabled here
end