CanCan and controllers without models

You can especify the controller within the ability.rb file:

ability.rb:

can :read, StatisticsController # ability.rb

StatisticsController:

class StatisticsController < ApplicationController

  def read
    authorize! :read, current_user 
  end
end

Use authorize_resource :class => false in your controller. CanCan will automatically check for abilities on the name of the controller (as a symbol, singular, eg :statistic for the StatisticsController)

See https://github.com/ryanb/cancan/wiki/Non-RESTful-Controllers

None of the other answers worked for me but the following did:

can :read, :statistics # ability.rb

Then, in the controller you can either use

class StatisticsController < ApplicationController
  authorize_resource class: false
end

which will call authorize! :<action>, :statistics for you, or you can do it per action explicitly:

class StatisticsController < ApplicationController
  def index
    authorize! :read, :statistics
  end
end