# Nested Routes and Consistent IDs / Security

**URL:** <https://www.ruby-forum.com/t/nested-routes-and-consistent-ids-security/125265>\
**Category:** Rails\
**Created:** [January 7, 2008, 4:37pm UTC](https://www.ruby-forum.com/t/nested-routes-and-consistent-ids-security/125265 "2008-01-07T16:37:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![knb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/7ab992/32.png) [@knb](https://www.ruby-forum.com/u/knb)\
**Post date:** [January 7, 2008, 4:37pm UTC](https://www.ruby-forum.com/t/nested-routes-and-consistent-ids-security/125265/1 "2008-01-07T16:37:48Z")

</div>

What is the standard method of ensuring that the IDs in a nested route  
are consistent with one another?

Suppose my RESTful rails app uses the following route:

users/5/albums/2/photos/7

A GET request to this route will trigger the ‘show’ action for a  
photo. Now, this action only needs the final id of 7 to render the  
photo, which means that

users/20/albums/20/photos/7

will render the same photo from the same album. This is sloppy and  
potentially insecure.

The most obvious solution would be to check that these IDs are  
consistent in some kind of before\_filter, and then redirect if they’re  
not.

I’m just wondering if there’s some standard, clever way of doing  
this. A best practice, perhaps? How do developers handle this?

Thanks

---

<div class="post-metadata">

**Author:** ![knb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/7ab992/32.png) [@knb](https://www.ruby-forum.com/u/knb)\
**Post date:** [January 7, 2008, 5:12pm UTC](https://www.ruby-forum.com/t/nested-routes-and-consistent-ids-security/125265/2 "2008-01-07T17:12:01Z")

</div>

In your show method:

```
@photo = User.find

```

(params[:user\_id]).albums.find(params[:album\_id]).photos.find(params[:id])