# How to prevent users from looking at other user's data

**URL:** <https://www.ruby-forum.com/t/how-to-prevent-users-from-looking-at-other-users-data/160105>\
**Category:** Rails\
**Created:** [February 11, 2009, 9:09pm UTC](https://www.ruby-forum.com/t/how-to-prevent-users-from-looking-at-other-users-data/160105 "2009-02-11T21:09:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gerwin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/a6a055/32.png) [@Gerwin](https://www.ruby-forum.com/u/Gerwin)\
**Post date:** [February 11, 2009, 9:09pm UTC](https://www.ruby-forum.com/t/how-to-prevent-users-from-looking-at-other-users-data/160105/1 "2009-02-11T21:09:53Z")

</div>

Say I have Users. A user can login and create e.g. Houses…and Houses  
can contain People …etc.

How do I prevent another logged in user from accessing another user’s  
House (e.g. [http://test.com/houses/1](http://test.com/houses/1) → where id=1 doesn’t belong to  
this user but to another user).

Would People also need to have a user\_id field so I can check if the  
request was done by the correct user?

---

<div class="post-metadata">

**Author:** ![Gerwin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/a6a055/32.png) [@Gerwin](https://www.ruby-forum.com/u/Gerwin)\
**Post date:** [February 11, 2009, 9:31pm UTC](https://www.ruby-forum.com/t/how-to-prevent-users-from-looking-at-other-users-data/160105/2 "2009-02-11T21:31:07Z")

</div>

Gerwin wrote:

> Say I have Users. A user can login and create e.g. Houses…and Houses  
> can contain People …etc.
> 
> How do I prevent another logged in user from accessing another user’s  
> House (e.g. [http://test.com/houses/1](http://test.com/houses/1) → where id=1 doesn’t belong to  
> this user but to another user).
> 
> Would People also need to have a user\_id field so I can check if the  
> request was done by the correct user?

There are various ways to accomplish this but basically you want to make  
sure houses can only be accesses through a user.

## HousesController

def index  
user = User.find(current\_user)  
@houses = user.houses.find(1)  
…  
…  
end

That’s the basic idea anyway.

---

<div class="post-metadata">

**Author:** ![Gerwin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/a6a055/32.png) [@Gerwin](https://www.ruby-forum.com/u/Gerwin)\
**Post date:** [February 12, 2009, 2:31am UTC](https://www.ruby-forum.com/t/how-to-prevent-users-from-looking-at-other-users-data/160105/3 "2009-02-12T02:31:10Z")

</div>

On Feb 11, 12:31 pm, Robert W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> end
> 
> ## That’s the basic idea anyway.
> 
> Posted viahttp://www.ruby-forum.com/.

Thanks! I didn’t know that something like  
current\_user.houses.people.find\_by\_id(param[:id]) would work 🙂