Turn ActionController::Verification into a plugin

On the topic of "pluginizing" code, how does everyone feel about
removing verification from ActionController. Guarding against or only
allowing a certain method should be handled in routing (Hopefully done
RESTfully).

http://dev.rubyonrails.org/ticket/9517

I kinda like "verify". Guess it should stay in core.

Just wondering how you are still using?

REST style controllers aren't a requirement in Rails. If REST becomes
mandatory, I can see where Verifications aren't necessary anymore
though.

You can still do

map.connect 'users/create', :controller => 'users', :action =>
'create', :requirements => { :method => :post }

instead of

verify :only => :create, :method => :post

verify :only => :create, :method => :post

All verify does is generate a before filter, it seems to confuse the
heck out of new users too. Just watch people trying to debug a 'GET
/foo/destroy/1' error.

Is there anyone here using verification in anger? How are you using it?

Is there anyone here using verification in anger? How are you using it?

Here's one example:

class AmnesiaController < ApplicationController
  verify :method => :post, :only =>
[ :send_password, :send_account_holder_user_name ]

This is from Highrise. There are still controllers that doesn't
necessarily makes sense as REST, but still needs to have protection
against bad verbs being applied.

We also use verifiy in Basecamp to guard against a request having the
right parameters.

So I'd say it still has real use and shouldn't be pluginized.

Here's one example:

class AmnesiaController < ApplicationController
  verify :method => :post, :only =>
[ :send_password, :send_account_holder_user_name ]

This is from Highrise. There are still controllers that doesn't
necessarily makes sense as REST, but still needs to have protection
against bad verbs being applied.

We also use verifiy in Basecamp to guard against a request having the
right parameters.

So I'd say it still has real use and shouldn't be pluginized.

Interestingly every example people have cited is only using :method. Not:

verify :params => "post", :session => "post", "flash" => "note",
           :only => :update_post,
           :add_flash => { "alert" => "Failed to create your message" },
           :redirect_to => :category_url

etc.

Perhaps the crazy stuff can be pluginized at some later date...