# Opinions needed

**URL:** <https://www.ruby-forum.com/t/opinions-needed/87568>\
**Category:** Rails\
**Created:** [March 4, 2007, 1:18am UTC](https://www.ruby-forum.com/t/opinions-needed/87568 "2007-03-04T01:18:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![KendallJ](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/a8b319/32.png) [@KendallJ](https://www.ruby-forum.com/u/KendallJ)\
**Post date:** [March 4, 2007, 1:18am UTC](https://www.ruby-forum.com/t/opinions-needed/87568/1 "2007-03-04T01:18:04Z")

</div>

I’d like to get some opinions out there from some skillful Rails  
programmers. Let me ask if a certain scenario is possible. I would  
like to expose the major portion of my web app, which acts as a  
workspace, to anyone that accesses it without any form of signup. In  
the workspace they have the ability to manipulate text fields, etc.  
and then save them to a database. The fact that they visit and work  
in the workspace would save a cookie to their computer. That cookie  
could remember which “user” visited and therefore access their data  
again. However upon revisiting rather than allow them to continue,  
force them to sign in.

My question is this: what are the security concerns for a web app to  
create generic users simply by a person visiting a site rather than  
signing up?

Thanks much for any input. You all’s awesome.

---

<div class="post-metadata">

**Author:** ![KendallJ](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/a8b319/32.png) [@KendallJ](https://www.ruby-forum.com/u/KendallJ)\
**Post date:** [March 4, 2007, 5:16am UTC](https://www.ruby-forum.com/t/opinions-needed/87568/2 "2007-03-04T05:16:25Z")

</div>

The security concerns depend on the business of the web site.