ruby on rails - Before filter on new and create actions? -

i have security related, general question rails.

let's assume have controller this:

def projectscontroller    before_action :user_has_paid, :only => [ :new, :create ]      ...    def new     @project = project.new   end    def create     @project = current_user.projects.build(project_params)     if @project.save       flash[:success] = "project saved."       redirect_to projects_path     else       render :new     end   end    ...    private      def user_has_paid       if current_user.has_not_paid?         flash[:notice] = "you must pay first."         redirect_to payments_path       end     end  end 

from security point-of-view: need before_action on both new and create action?

to save couple of sql queries use on new action only, wonder if that's save or if malicious user might able circumvent new action , create project anyway, without having paid first.

thanks advice.

from security perspective you'll want have before_action on create action (otherwise malicious user user curl or bypass paying). whether have on new action depend on desired user experience - want users trying request 'new' view redirected (i.e. don't see view unless they've paid), or want allow users see view (and perhaps render warning message needing pay before submitting create action).

from performance standpoint, unless call current_user.has_not_paid? particularly intensive wouldn't worry queries.