# Hidden URL

**URL:** <https://www.ruby-forum.com/t/hidden-url/119193>\
**Category:** Rails\
**Created:** [November 4, 2007, 7:27pm UTC](https://www.ruby-forum.com/t/hidden-url/119193 "2007-11-04T19:27:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [November 4, 2007, 7:27pm UTC](https://www.ruby-forum.com/t/hidden-url/119193/1 "2007-11-04T19:27:22Z")

</div>

Hello,

I have in my application a private public URL. For those who know  
Flickr, it is sorta like the URL you give to your friend for them to  
access your photos. Usually the URL looks like this:

[http://www.domain.com/url/khjuytf678ysdfksdgihsd](http://www.domain.com/url/khjuytf678ysdfksdgihsd)

Where “khjuytf678ysdfksdgihsd” is an encoded path. Let say I want to  
have a public-private page for:

[http://www.domain.com/event/124/pinvitation/12](http://www.domain.com/event/124/pinvitation/12)

Now I created a controller called URLController that take the encoded  
path and redirect to it:  
“khjuytf678ysdfksdgihsd” becomes “event/124/pinvitation/12”

That works well. But an evil mind can actually directly write “event/  
124/pinvitation/12” in the browser and access the same page.

The other way I could do this is hide everything behind the  
URLController and make the redirection transparent to the browser (so  
the browser always thinks it is page “url/khjuytf678ysdfksdgihsd”).  
But I don’t know how I can achieve that because redirect\_to always  
change the url.

So my question is, how can I restrict the path “event/124/pinvitation/  
12” as being redirected from the URLController. Can I put a condition  
on the route for this?

I guess this is a classic problem 🙂

Thank you very much,  
Julien.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [November 4, 2007, 8:36pm UTC](https://www.ruby-forum.com/t/hidden-url/119193/2 "2007-11-04T20:36:28Z")

</div>

One initial thought I have is use the idea of always showing the  
browser the encoded url, but instead of redirecting, call the  
appropriate action from the URLController, but make those called  
actions protected so they can’t be called directly from a browser.  
Make sense? I haven’t tried or tested it, but it should work.

-Bill

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [November 4, 2007, 11:39pm UTC](https://www.ruby-forum.com/t/hidden-url/119193/3 "2007-11-04T23:39:10Z")

</div>

Hello,

Always show the encoded url will allow the user to bookmark the page  
also, which is a good thing.  
If I call the other controller actions using render… it does not  
execute the controller code, it goes directly to render the associated  
view.

Also what happens with the encoded url when the user trigger action on  
the page (like leaving a comment for example). The url for the form  
would be the url of the “protected” controller and not another encoded  
url. So basically all URL for a private-public page will have to be  
encoded in some way.

I am wondering if some deep functionality in rails can help me with  
that.

Thanks,  
Julien.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [November 5, 2007, 4:18am UTC](https://www.ruby-forum.com/t/hidden-url/119193/4 "2007-11-05T04:18:36Z")

</div>

Hello,

I got into reading this:  
[http://weblog.jamisbuck.org/2006/10/4/under-the-hood-route-recognition-in-rails](http://weblog.jamisbuck.org/2006/10/4/under-the-hood-route-recognition-in-rails)

And i think I can put the code for decrypting the url in a special  
implementation of the route.

Let’s hope it doesn’t slow everthing down too much.

Thanks!  
Julien.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [November 4, 2007, 11:44pm UTC](https://www.ruby-forum.com/t/hidden-url/119193/5 "2007-11-04T23:44:27Z")

</div>

I wouldn’t call the other method using render, call the other method  
directly and let it render the results.

-Bill