# Prefered way to deny access **URL:** \ **Category:** Rails\ **Created:** [December 20, 2007, 11:37am UTC](https://www.ruby-forum.com/t/prefered-way-to-deny-access/123754 "2007-12-20T11:37:59Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jawosis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f04885/32.png) [@jawosis](https://www.ruby-forum.com/u/jawosis)\ **Post date:** [December 20, 2007, 11:37am UTC](https://www.ruby-forum.com/t/prefered-way-to-deny-access/123754/1 "2007-12-20T11:37:59Z")
Lets say I have a session based login system: username = session[:username] (jochen) userid = session[:userid] (1) Now I want to book a room: [http://127.0.0.1:3000/guests/1/bookings/new](http://127.0.0.1:3000/guests/1/bookings/new) (works) But when I type [http://127.0.0.1:3000/guests/5/bookings/new](http://127.0.0.1:3000/guests/5/bookings/new) I can book a room for a different user. Whats the prefered way to deny success to urls including a userid so that I can only access these url which include my userid? Thanx – Jochen ---
**Author:** ![jawosis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f04885/32.png) [@jawosis](https://www.ruby-forum.com/u/jawosis)\ **Post date:** [December 20, 2007, 12:24pm UTC](https://www.ruby-forum.com/t/prefered-way-to-deny-access/123754/2 "2007-12-20T12:24:55Z")
Why would you store the current user’s ID in the URL anyway? That’s a major security risk. It can be better handled by storing the user ID in a session[:user] or session[:user\_id] variable. Check out how acts\_as\_authenticated and restful\_authenticated does it. On Dec 20, 2007 9:13 PM, Thorsten M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > by the way: no need, to store the username in session, id is enough > > – > Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/). > > > – Ryan B. > **[frozenplague.net](http://www.frozenplague.net)** > > This domain may be for sale! ---
**Author:** ![jawosis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f04885/32.png) [@jawosis](https://www.ruby-forum.com/u/jawosis)\ **Post date:** [December 20, 2007, 1:35pm UTC](https://www.ruby-forum.com/t/prefered-way-to-deny-access/123754/3 "2007-12-20T13:35:14Z")
Am 20.12.2007 um 12:24 schrieb Ryan B.: > Why would you store the current user’s ID in the URL anyway? [http://127.0.0.1:3000/guests/1/bookings/new](http://127.0.0.1:3000/guests/1/bookings/new) That’s the way rails does, or? ---
**Author:** ![jawosis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f04885/32.png) [@jawosis](https://www.ruby-forum.com/u/jawosis)\ **Post date:** [December 20, 2007, 11:43am UTC](https://www.ruby-forum.com/t/prefered-way-to-deny-access/123754/4 "2007-12-20T11:43:36Z")
your user model defines: has\_many :bookings so after finding the current user like: def current\_user @current\_user ||= User.find(session[:userid]) end in application.rb you can use current\_user.bookings.create(…) that way nobody can access data of somebody else. same goes for index/show actions etc. current\_user.bookings.each do |booking| … end by the way: no need, to store the username in session, id is enough ---
**Author:** ![jawosis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f04885/32.png) [@jawosis](https://www.ruby-forum.com/u/jawosis)\ **Post date:** [December 20, 2007, 1:43pm UTC](https://www.ruby-forum.com/t/prefered-way-to-deny-access/123754/5 "2007-12-20T13:43:24Z")
I would suggest installing the restful\_authentication plugin Once done one way of doing it is in the bookings controller add the following filter before\_filter :login\_required And add a subsequent authorized? method to check if the url user\_id matches the current user, The code below checks the user is logged in and is in the correct role. def authorized? logged\_in? && (current\_user.roles.in\_role(‘company’) or current\_user.roles.in\_role(‘admin’)) end ---
**Author:** ![jawosis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f04885/32.png) [@jawosis](https://www.ruby-forum.com/u/jawosis)\ **Post date:** [December 20, 2007, 9:12pm UTC](https://www.ruby-forum.com/t/prefered-way-to-deny-access/123754/6 "2007-12-20T21:12:25Z")
> That’s the way rails does, or? > > No, that’s not the way Rails should do something like that. It should > store it as a session variable. – Ryan B. > **[frozenplague.net](http://www.frozenplague.net)** > > This domain may be for sale! ---
**Author:** ![jawosis](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f04885/32.png) [@jawosis](https://www.ruby-forum.com/u/jawosis)\ **Post date:** [December 20, 2007, 9:28pm UTC](https://www.ruby-forum.com/t/prefered-way-to-deny-access/123754/7 "2007-12-20T21:28:17Z")
Unless you’re nesting your routes, which in this case might make sense. –Jeremy On Dec 20, 2007 3:00 PM, Ryan B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Ryan B. > [http://www.frozenplague.net](http://www.frozenplague.net) > > > – [http://www.jeremymcanally.com/](http://www.jeremymcanally.com/) My books: Ruby in Practice > **[Ruby in Practice](https://www.manning.com/books/ruby-in-practice)** > > Like Ruby itself, Ruby in Practice will make you more productive. The book shows you practical techniques and strategies for small projects and large-scale environments. A cookbook-style reference, it gives you concrete examples of systems... My free Ruby e-book > **[Site not found · DreamHost](http://www.humblelittlerubybook.com/)** > > The owner of this domain has not yet uploaded their website. My blogs: > **[Site not found · DreamHost](http://www.mrneighborly.com/)** > > The owner of this domain has not yet uploaded their website. [http://www.rubyinpractice.com/](http://www.rubyinpractice.com/)