# Exposing id'd **URL:** \ **Category:** Rails\ **Created:** [January 7, 2006, 10:08pm UTC](https://www.ruby-forum.com/t/exposing-idd/94664 "2006-01-07T22:08:59Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![reevesg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a6a055/32.png) [@reevesg](https://www.ruby-forum.com/u/reevesg)\ **Post date:** [January 7, 2006, 10:08pm UTC](https://www.ruby-forum.com/t/exposing-idd/94664/1 "2006-01-07T22:08:59Z")
I have been working on a small app that started with some scaffolding. Some of my actions still have the structure where the id’s of things are passed on the url for gets. Whats the best way to avoid the security problems that this creates? I am sure that there are many pages written on this topic but I guess I have been searching for the wrong things. Thanks Gareth ---
**Author:** ![reevesg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a6a055/32.png) [@reevesg](https://www.ruby-forum.com/u/reevesg)\ **Post date:** [January 7, 2006, 11:16pm UTC](https://www.ruby-forum.com/t/exposing-idd/94664/2 "2006-01-07T23:16:58Z")
On 1/7/06, Gareth R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I have been working on a small app that started with some scaffolding. > Some of my actions still have the structure where the id’s of things are > passed on the url for gets. > > Whats the best way to avoid the security problems that this creates? > > I am sure that there are many pages written on this topic but I guess I > have been searching for the wrong things. You can use Routes to remove those id values (though I wouldn’t call them a security problem.) [http://manuals.rubyonrails.com/read/chapter/65](http://manuals.rubyonrails.com/read/chapter/65) Also, if you define “to\_param” in your models, you can make setting up those routes even easier: [http://dev.rubyonrails.org/ticket/812](http://dev.rubyonrails.org/ticket/812) ---
**Author:** ![reevesg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a6a055/32.png) [@reevesg](https://www.ruby-forum.com/u/reevesg)\ **Post date:** [January 8, 2006, 12:40am UTC](https://www.ruby-forum.com/t/exposing-idd/94664/3 "2006-01-08T00:40:10Z")
Wilson B. wrote: > On 1/7/06, Gareth R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > I have been working on a small app that started with some scaffolding. > > Some of my actions still have the structure where the id’s of things are > > passed on the url for gets. > > > > Whats the best way to avoid the security problems that this creates? > > > > I am sure that there are many pages written on this topic but I guess I > > have been searching for the wrong things. > > You can use Routes to remove those id values (though I wouldn’t call > them a security problem.) > [Peak Obsession](http://manuals.rubyonrails.com/read/chapter/65) > > Also, if you define “to\_param” in your models, you can make setting up > those routes even easier: > [http://dev.rubyonrails.org/ticket/812](http://dev.rubyonrails.org/ticket/812) The issues that I am concerned about is just having users be able to hack a url to give them access to something that they shouldnt have access to. I probably should check that the current user has permissions to see the thing that they are lookin for in each of the actions. How do other people deal with this ? Gareth ---
**Author:** ![reevesg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a6a055/32.png) [@reevesg](https://www.ruby-forum.com/u/reevesg)\ **Post date:** [January 8, 2006, 12:44am UTC](https://www.ruby-forum.com/t/exposing-idd/94664/4 "2006-01-08T00:44:40Z")
Gareth R. wrote: > The issues that I am concerned about is just having users be able to > hack a url to give them access to something that they shouldnt have > access to. I probably should check that the current user has permissions > to see the thing that they are lookin for in each of the actions. > > How do other people deal with this ? As a rule, security through obscurity is a bad idea. It’s better than nothing, but not by much. If you are concerned about who sees a record, you need to set up some method to check and ensure that the user is actually entitled to see it. Exactly how you do that will depend on your application and user model. ---
**Author:** ![reevesg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a6a055/32.png) [@reevesg](https://www.ruby-forum.com/u/reevesg)\ **Post date:** [January 8, 2006, 12:51am UTC](https://www.ruby-forum.com/t/exposing-idd/94664/5 "2006-01-08T00:51:49Z")
Kevin O. wrote: > Gareth R. wrote: > > > The issues that I am concerned about is just having users be able to > > hack a url to give them access to something that they shouldnt have > > access to. I probably should check that the current user has permissions > > to see the thing that they are lookin for in each of the actions. > > > > How do other people deal with this ? > > As a rule, security through obscurity is a bad idea. It’s better than > nothing, but not by much. If you are concerned about who sees a record, > you need to set up some method to check and ensure that the user is > actually entitled to see it. Exactly how you do that will depend on > your application and user model. Agreed. I was planning on doing both but not sure how or if its possible to avoid exposing the ids urls. Gareth ---
**Author:** ![reevesg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a6a055/32.png) [@reevesg](https://www.ruby-forum.com/u/reevesg)\ **Post date:** [January 8, 2006, 1:35am UTC](https://www.ruby-forum.com/t/exposing-idd/94664/6 "2006-01-08T01:35:23Z")
In general, you should assume that users can get to any URL in your app. As Kevin suggests, you need to write code to stop them WHEN they get to the right URL, rather than just preventing them from knowing what the right URL is. For example, the Salted Login code uses a before\_filter in each controller that should be protected. A user can only got to a protected URL if they’re logged in. Obviously, you want something more granular than that- it’s not just that they’re logged in, it’s that they have certain rights on the particular thing they’re viewing or editing. Again, as Kevin suggests, you need to decide what those rights are and how they work for your app, and then code it. ---
**Author:** ![reevesg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a6a055/32.png) [@reevesg](https://www.ruby-forum.com/u/reevesg)\ **Post date:** [January 8, 2006, 2:06am UTC](https://www.ruby-forum.com/t/exposing-idd/94664/7 "2006-01-08T02:06:37Z")
Gareth R. wrote: > Agreed. I was planning on doing both but not sure how or if its possible > to avoid exposing the ids urls. > > Gareth Keep in mind that users can bookmark pages if you put the id in the URL. If you want them to be able to do that, you need to keep the id’s there. One approach I have used in the past to hide the id is to stuff it into the session hash. ---
**Author:** ![reevesg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a6a055/32.png) [@reevesg](https://www.ruby-forum.com/u/reevesg)\ **Post date:** [January 8, 2006, 3:17am UTC](https://www.ruby-forum.com/t/exposing-idd/94664/8 "2006-01-08T03:17:34Z")
On Jan 7, 2006, at 3:40 PM, Gareth R. wrote: > > > I am sure that there are many pages written on this topic but I > > > [http://dev.rubyonrails.org/ticket/812](http://dev.rubyonrails.org/ticket/812) > > The issues that I am concerned about is just having users be able to > hack a url to give them access to something that they shouldnt have > access to. I probably should check that the current user has > permissions > to see the thing that they are lookin for in each of the actions. I have a ticket in, with code attached, to provide one answer to this question: [http://dev.rubyonrails.org/ticket/2408](http://dev.rubyonrails.org/ticket/2408) – – Tom M. ---
**Author:** ![reevesg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/a6a055/32.png) [@reevesg](https://www.ruby-forum.com/u/reevesg)\ **Post date:** [January 8, 2006, 7:11am UTC](https://www.ruby-forum.com/t/exposing-idd/94664/9 "2006-01-08T07:11:05Z")
On 1/7/06, Gareth R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > > > access to. I probably should check that the current user has permissions > Rails mailing list > removed\_email\_address@domain.invalid > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) One thing to keep in mind is to always use associations for finding things when you’ve got them set up. For example, you have a User model and an JournalEntry model, and a User has many JournalEntries. If you want users to only be able to access their own journal entries, just be sure to access the entries through the user object. So something like this in your controller: entry = session[:user].journal\_entries.find(params[:id]) This ends up being the same as JournalEntry.find\_by\_id\_and\_user\_id(params[:id], session[:user].id), but it’s obviously way more concise and logical. Anyway, that’s a pretty simple way of making sure that people don’t get to view something they shouldn’t. As far as restricting access to controllers and individual actions, you can look into using the UserEngine which implements basic RBAC. Pat