# Is this a necessary precaution? **URL:** \ **Category:** Rails\ **Created:** [March 9, 2007, 1:49am UTC](https://www.ruby-forum.com/t/is-this-a-necessary-precaution/88232 "2007-03-09T01:49:03Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![anonymous](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8491ac/32.png) [@anonymous](https://www.ruby-forum.com/u/anonymous)\ **Post date:** [March 9, 2007, 1:49am UTC](https://www.ruby-forum.com/t/is-this-a-necessary-precaution/88232/1 "2007-03-09T01:49:03Z")
If I’m not mistaken, a user can send POST data from outside of a web browser; I think this is something that is done to brute-force form logins, or to automate spam, etc. In my app, which operates like a forum, Comment objects have a boolean attribute “sticky” which determines if that Comment is displayed before all other comments. I was thinking, what would happen if a user forcefully sent “sticky =\> true” in POST data? I would imagine my app’s new\_comment action would simply create a new object from that data and falsely make his or her post a sticky-post. Is this a possibility, and is it something I should be trying to prevent? Just something I recently pondered. ---
**Author:** ![anonymous](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8491ac/32.png) [@anonymous](https://www.ruby-forum.com/u/anonymous)\ **Post date:** [March 9, 2007, 2:28am UTC](https://www.ruby-forum.com/t/is-this-a-necessary-precaution/88232/2 "2007-03-09T02:28:45Z")
On Mar 8, 2007, at 7:49 PM, Anonymous wrote: > If I’m not mistaken, a user can send POST data from outside of a web > browser; I think this is something that is done to brute-force form > logins, or to automate spam, etc. Yes, and often for testing. > be trying to prevent? Just something I recently pondered. > That is a danger if you’re doing something like: MyModel.create(params[:my\_model]) without checking the param values . You probably want to take a look at the attr\_protected method: [http://rails.rubyonrails.org/classes/ActiveRecord/Base.html#M001005](http://rails.rubyonrails.org/classes/ActiveRecord/Base.html#M001005) James. – James S. Play: [http://james.anthropiccollective.org](http://james.anthropiccollective.org) Work: [Processing Greenbelt 2009 – James Stewart](http://jystewart.net/process/) ---
**Author:** ![anonymous](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8491ac/32.png) [@anonymous](https://www.ruby-forum.com/u/anonymous)\ **Post date:** [March 9, 2007, 2:47am UTC](https://www.ruby-forum.com/t/is-this-a-necessary-precaution/88232/3 "2007-03-09T02:47:47Z")
Yes, this is the reason for captchas and user-logins. You should be actively thinking about how people can attack your app from both within and without a web browser. If you’re allowing your objects to be modified via POSTs, you should probably authenticate the call first. You have some sort of login system, right? ---
**Author:** ![anonymous](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8491ac/32.png) [@anonymous](https://www.ruby-forum.com/u/anonymous)\ **Post date:** [March 9, 2007, 2:50am UTC](https://www.ruby-forum.com/t/is-this-a-necessary-precaution/88232/4 "2007-03-09T02:50:48Z")
Ah okay, I was right. I was preventing it by: self[:sticky] = nil during before\_create. I was previously unaware of attr\_protected which is obviously a much cleaner solution. Thanks. > Yes, and often for testing. > Sigh. One day I’ll actually learn how to do this. I don’t know why > I’ve allowed myself to go so long without. ---
**Author:** ![anonymous](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8491ac/32.png) [@anonymous](https://www.ruby-forum.com/u/anonymous)\ **Post date:** [March 9, 2007, 3:27am UTC](https://www.ruby-forum.com/t/is-this-a-necessary-precaution/88232/5 "2007-03-09T03:27:16Z")
You might want to check out this link[1] as well. It cautions about your very problem, and has a few other precautions you can take to harden your application. Nelson [1] [Peak Obsession](http://manuals.rubyonrails.com/read/book/8) Anonymous wrote: > Ah okay, I was right. > > I was preventing it by: self[:sticky] = nil during before\_create. I was > previously unaware of attr\_protected which is obviously a much cleaner > solution. Thanks. > > > Yes, and often for testing. > > Sigh. One day I’ll actually learn how to do this. I don’t know why > > I’ve allowed myself to go so long without.