# Clean URL's and User Authentication **URL:** \ **Category:** Rails\ **Created:** [August 6, 2007, 4:38pm UTC](https://www.ruby-forum.com/t/clean-urls-and-user-authentication/111373 "2007-08-06T16:38:26Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [August 6, 2007, 4:38pm UTC](https://www.ruby-forum.com/t/clean-urls-and-user-authentication/111373/1 "2007-08-06T16:38:26Z")
Users who are logged into a form that I am working on are only allowed to visited pages if they are logged in. If they are not logged in, they get kicked back to the login page. This was achieved by placing the following code in my controller: before\_filter :check\_authentication, :except =\> [:create\_user, :traveler\_form, :signin]’ What I have noticed, is that in the URL the user’s id is shown. So a user that is logged in can enter another user’s id (assuming that they guess the correct id number), and they can see there info. I have a couple of ideas about how to stop this: 1) Cleaning the url of user id info, or adding some kind of check that check the user’s coookie to make sure they are who they say they are. Ideally, I would like to do both, but am focusing on making sure the user can only see their user info. Can any one give me some direction of where to start on how to do this? Thanks, ~S ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [August 6, 2007, 5:12pm UTC](https://www.ruby-forum.com/t/clean-urls-and-user-authentication/111373/2 "2007-08-06T17:12:32Z")
I’ve started programming rails, so my comments may not count for much, but actually, I think there’s an easier solution to that problem: changing your routes. search for the config directory, and you should find routes.rb . Near the bottom, there should be the line: map.connect ‘:controller/:action/:id.:format’ map.connect ‘:controller/:action/:id’ just take out the :id (and :id.format) part, and give that a try. I believe that so long as params[:id] holds the id value, the program will still manage to redirect as if you gave it the id value. ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [August 6, 2007, 5:23pm UTC](https://www.ruby-forum.com/t/clean-urls-and-user-authentication/111373/3 "2007-08-06T17:23:24Z")
Taro wrote: > I’ve started programming rails, so my comments may not count for much, > but actually, I think there’s an easier solution to that problem: > changing your routes. > > search for the config directory, and you should find routes.rb . Near > the bottom, there should be the line: > map.connect ‘:controller/:action/:id.:format’ > map.connect ‘:controller/:action/:id’ > just take out the :id (and :id.format) part, and give that a try. I > believe that so long as params[:id] holds the id value, the program > will still manage to redirect as if you gave it the id value. I have tried that and I get a routing error. Not sure why, cause the references I have say that should be a solution as well?? Thanks though, I’ll keep trying, ~S ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [August 6, 2007, 6:29pm UTC](https://www.ruby-forum.com/t/clean-urls-and-user-authentication/111373/4 "2007-08-06T18:29:48Z")
> I have tried that and I get a routing error. Not sure why, cause the > references I have say that should be a solution as well?? Thanks though, > I’ll keep trying, Huh. You could attempt to use another unique parameter to pass in instead of the id (for example, username), but I doubt that’ll improve anything, just make things more predictable… ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [August 6, 2007, 6:43pm UTC](https://www.ruby-forum.com/t/clean-urls-and-user-authentication/111373/5 "2007-08-06T18:43:49Z")
## I do have a solution for your second method. Assuming the model name is User, and assuming you are using sessions instead of cookie, just use the if/else statement: ## #first make sure the User actually exists if user=User.find(params[:id]) #compare params[:id] to session[:user\_id] if session[:user\_id]==user.id #do important things else #redirect end else #redirect end I forget how the cookie system works, if you’re using that, but the basic concept should remain the same: controllers can call the cookie/ session anytime to make comparisons with the params hash object. ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [August 7, 2007, 9:20pm UTC](https://www.ruby-forum.com/t/clean-urls-and-user-authentication/111373/6 "2007-08-07T21:20:52Z")
You’re Welcome! I’m glad I could help you! A little note: I was a little confused when you said session[:user] held the id. For security reasons, it’s best only to hold the id; but if you say something like session[:user]=@user, it _should_ store the whole object (I haven’t tested this out, yet, so I don’t know). In that case, yes, session[:user].id should work. As I mentioned before, though, that’s a very bad idea. It means you’re storing the password data into the sessions, and sessions are simply not as secure as databases are. If you need to keep any info about the user, only store the id, and leave the find method do all the work. On Aug 7, 12:00 pm, Shandy N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [August 7, 2007, 6:00pm UTC](https://www.ruby-forum.com/t/clean-urls-and-user-authentication/111373/7 "2007-08-07T18:00:36Z")
Taro wrote: > ## I do have a solution for your second method. Assuming the model name is User, and assuming you are using sessions instead of cookie, just use the if/else statement: > > ## #first make sure the User actually exists if user=User.find(params[:id]) #compare params[:id] to session[:user\_id] if session[:user\_id]==user.id #do important things else #redirect end else #redirect end > > I forget how the cookie system works, if you’re using that, but the > basic concept should remain the same: controllers can call the cookie/ > session anytime to make comparisons with the params hash object. That worked. Originally I had session[:user].id which I thought would hold the id, but apparently session[:user] is the id. Just something that threw me for a loop so hopefully other people won’t make the same mistake. Thanks Taro, ~S ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [August 7, 2007, 10:32pm UTC](https://www.ruby-forum.com/t/clean-urls-and-user-authentication/111373/8 "2007-08-07T22:32:31Z")
Taro wrote: > You’re Welcome! I’m glad I could help you! > A little note: > I was a little confused when you said session[:user] held the id. For > security reasons, it’s best only to hold the id; but if you say > something like session[:user]=@user, it _should_ store the whole > object (I haven’t tested this out, yet, so I don’t know). In that > case, yes, session[:user].id should work. > As I mentioned before, though, that’s a very bad idea. It means > you’re storing the password data into the sessions, and sessions are > simply not as secure as databases are. If you need to keep any info > about the user, only store the id, and leave the find method do all > the work. > > On Aug 7, 12:00 pm, Shandy N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) I think I was more confusing myself. My code looks like: session[:user] = User.authenticate(params[:current\_user][:emailaddr], params[:user\_password]).id I think I just didn’t see the .id on the end. My authenticate method returns a user object which I then just get the id from and store it in the session[:user] variable.