# Questions about rails 2.0

**URL:** <https://www.ruby-forum.com/t/questions-about-rails-2-0/122577>\
**Category:** Rails\
**Created:** [December 9, 2007, 7:37pm UTC](https://www.ruby-forum.com/t/questions-about-rails-2-0/122577 "2007-12-09T19:37:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@mix](https://www.ruby-forum.com/u/mix)\
**Post date:** [December 9, 2007, 7:37pm UTC](https://www.ruby-forum.com/t/questions-about-rails-2-0/122577/1 "2007-12-09T19:37:03Z")

</div>

Hi, i’ve found some questions on the rails blog which haven’t any  
answer. Because i’m interested too i paste them here:

# gonzo on 07 Dec 22:10:

Does CSRF protection work with forms that are fully cached?

# rugal on 08 Dec 20:14:

Great job guys!

Just an information about migrations.

will t.timestamps create both created\_at and updated\_at? And for \_on ?  
t.datestamps? and if i want to create just one of them?

t.datetime “created\_at” ?

# rugal on 08 Dec 20:21:

i forgot another thing… about the HTTP Basic Authentication. in the code  
example there are both username and password set on the top of the  
class: USER\_NAME, PASSWORD = “dhh”, “secret”

authenticate\_or\_request\_with\_http\_basic do |user\_name, password|  
user\_name USER\_NAME && password PASSWORD end

and in the method you check if are equals. with a user model everything  
will be something like this?

authenticate\_or\_request\_with\_http\_basic do |user\_name, password| user =  
User.find\_by\_nick(user\_name) user && password == user.password end

(ok, in this case the password is not encrypted, but it’s just an  
example 🙂 )

Last question, what changes with the normal authentication? is it better  
using this by http? why?

thanks 🙂

# kgodel on 08 Dec 23:10:

David,

You mention that the cookies are “in a hashed form that can’t be  
forged”.

Why should I believe you?

Since “forged” is a rather vague word do you mean collision resistant,  
pre-image resistant, or 2nd pre-image resistant?

I haven’t glanced at all the code yet so I’ll assume your using some  
version of SHA-2 and are aware of the collision vulnerabilities in MD5  
and (the more difficult to generate) collision vulnerabilities in SHA-1.

Even so, “can’t be forged” sounds like snake oil, and is  
incontrovertibly incorrect (given enough time and enough parallel  
FPGAs).

---

<div class="post-metadata">

**Author:** ![mix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@mix](https://www.ruby-forum.com/u/mix)\
**Post date:** [December 11, 2007, 2:21pm UTC](https://www.ruby-forum.com/t/questions-about-rails-2-0/122577/2 "2007-12-11T14:21:56Z")

</div>

Anyone? ☹

---

<div class="post-metadata">

**Author:** ![mix](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@mix](https://www.ruby-forum.com/u/mix)\
**Post date:** [December 12, 2007, 1:16am UTC](https://www.ruby-forum.com/t/questions-about-rails-2-0/122577/3 "2007-12-12T01:16:12Z")

</div>

I don’t know about the first question. (CSRF protection)

The second question is right, you need to do t.datetime :created\_at to  
create one of them. :created\_at is favoured over created\_on (imo)

Third one not a clue.

Fourth one wasn’t even structured as a question.

On Dec 10, 2007 5:07 AM, Mix M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> # rugal on 08 Dec 20:14:
> 
> will be something like this?  
> thanks 🙂
> 
> –  
> Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/).
> 
> >

–  
Ryan B.

> **[frozenplague.net](http://www.frozenplague.net)**
>
> This domain may be for sale!