Rack::MiniProfiler.authorize_request vs Rack::MiniProfiler.config.pre_authorize_cb

[barmstrong]

I'm having a little trouble understanding the difference between these two.

Ideally, I'd like it to only show the miniprofiler if I call authorize_request. This seems to be the case in production. But in development it ignores authorize_request and obeys pre_authorize_cb so I have some duplicate logic in there.

Was just curious why the separate methods? Maybe there was some historical reason or another purpose I'm not aware of. Would it make sense to consolidate the two?

Thanks for the awesome gem. It's been a life saver.

[SamSaffron]

so sorry I have been so slack and have not replied.

main reason is that in pre_authorize you may not have enough information to authorize / deauthorize a client

If you want the behavior to be consistent with prd in dev try

Rack::MiniProfiler.config.authorization_mode = :whitelist