# Overcoming security via typing in the URL?

**URL:** <https://www.ruby-forum.com/t/overcoming-security-via-typing-in-the-url/105936>\
**Category:** Rails\
**Created:** [June 4, 2007, 8:29pm UTC](https://www.ruby-forum.com/t/overcoming-security-via-typing-in-the-url/105936 "2007-06-04T20:29:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![liberte](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/9e8a1a/32.png) [@liberte](https://www.ruby-forum.com/u/liberte)\
**Post date:** [June 4, 2007, 8:29pm UTC](https://www.ruby-forum.com/t/overcoming-security-via-typing-in-the-url/105936/1 "2007-06-04T20:29:55Z")

</div>

I’m creating a registration page where parents register their children  
for an event. I have each parent give me a username and password to  
login and register their children. Parents also have the ability to  
come back and edit their children’s information. However, if I log in  
as a parent to edit my child’s information, I can type another parent’s  
child’s id into the URL to edit that child.

For instance, say I log into the system and view my children, and the  
link to this is: …/children/edit/1, where 1 is the id of my child. I  
can go up to the URL and type in …/children/edit/2, and edit the  
information of a child other than my own. Is there any simple way to  
stop this and allow parents to edit ONLY their assocaited children?

My aplogies if this is a simple question; I’m new to web development and  
Ruby on Rails. But if anyone has a solution or can point me to a  
resource that can answer my question, I’d greatly appreciate it.

Thanks.  
Daniel L

---

<div class="post-metadata">

**Author:** ![liberte](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/9e8a1a/32.png) [@liberte](https://www.ruby-forum.com/u/liberte)\
**Post date:** [June 4, 2007, 8:34pm UTC](https://www.ruby-forum.com/t/overcoming-security-via-typing-in-the-url/105936/2 "2007-06-04T20:34:57Z")

</div>

Daniel L. wrote:

> information of a child other than my own. Is there any simple way to  
> stop this and allow parents to edit ONLY their assocaited children?
> 
> My aplogies if this is a simple question; I’m new to web development and  
> Ruby on Rails. But if anyone has a solution or can point me to a  
> resource that can answer my question, I’d greatly appreciate it.
> 
> Thanks.  
> Daniel L

You should be using associations to do the find. As in:

@parent = Parent.find params[:parent\_id]  
@child = @parent.children.find params[:child\_id]

That will only find children of @parent.

Check out  
[http://api.rubyonrails.com/classes/ActiveRecord/Associations/ClassMethods.html](http://api.rubyonrails.com/classes/ActiveRecord/Associations/ClassMethods.html)

–  
Jack C.  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![liberte](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/9e8a1a/32.png) [@liberte](https://www.ruby-forum.com/u/liberte)\
**Post date:** [June 4, 2007, 9:26pm UTC](https://www.ruby-forum.com/t/overcoming-security-via-typing-in-the-url/105936/3 "2007-06-04T21:26:15Z")

</div>

Richard L. wrote:

> There is still a security issue doing it his way  
> @parent = Parent.find params[:parent\_id]  
> since all someone has to do is put in ?parent\_id=whatever  
> If you used some sort of login generator you can do something like  
> current\_user.children.find params[:child\_id]  
> That way you are pulling the current\_user from the session.

Thank you for your advice. I believe the problem has been resolved.  
Thanks again!

---

<div class="post-metadata">

**Author:** ![liberte](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/9e8a1a/32.png) [@liberte](https://www.ruby-forum.com/u/liberte)\
**Post date:** [June 4, 2007, 9:00pm UTC](https://www.ruby-forum.com/t/overcoming-security-via-typing-in-the-url/105936/4 "2007-06-04T21:00:02Z")

</div>

There is still a security issue doing it his way  
@parent = Parent.find params[:parent\_id]  
since all someone has to do is put in ?parent\_id=whatever  
If you used some sort of login generator you can do something like  
current\_user.children.find params[:child\_id]  
That way you are pulling the current\_user from the session.

---

<div class="post-metadata">

**Author:** ![liberte](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/9e8a1a/32.png) [@liberte](https://www.ruby-forum.com/u/liberte)\
**Post date:** [June 4, 2007, 10:17pm UTC](https://www.ruby-forum.com/t/overcoming-security-via-typing-in-the-url/105936/5 "2007-06-04T22:17:34Z")

</div>

You are going to have to model parents as well as children, or require  
they enter the username/password for each child separately. Then in  
the before\_filter of your actions you need to verify that the session  
contains the username for the requested child. When they provide a  
username and password store the username in the session. If they fail  
to enter the correct username and password be sure to clear the  
session values so they can not keep trying.

Michael

On Jun 4, 11:29 am, Daniel L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)