# REST and Limiting Access

**URL:** <https://www.ruby-forum.com/t/rest-and-limiting-access/87403>\
**Category:** Rails\
**Created:** [March 2, 2007, 10:50am UTC](https://www.ruby-forum.com/t/rest-and-limiting-access/87403 "2007-03-02T10:50:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![captaffy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f04885/32.png) [@captaffy](https://www.ruby-forum.com/u/captaffy)\
**Post date:** [March 2, 2007, 10:50am UTC](https://www.ruby-forum.com/t/rest-and-limiting-access/87403/1 "2007-03-02T10:50:50Z")

</div>

I have a RESTful User class, but the User actions (minus new and create)  
require an application user to be logged in. This leads me to a bit of a  
REST conundrum.

The edit action for a specific User is obviously access with an url like  
[http://www.domain.com/users/1;edit](http://www.domain.com/users/1;edit)  
But I do not want the User with ID 1 to be able to edit User with ID 2’s  
with [http://www.domain.com/users/2;edit](http://www.domain.com/users/2;edit)

I am curious as to how people are handling situations like this.

I am currently using a before\_filter on these actions which checks if  
the User ID stored in the session is the same as the params ID. If not,  
it silently redirects to the same action, but with their ID. For  
example, a request of [http://www.domain.com/users/2](http://www.domain.com/users/2) from the application  
user logged in with an ID of 1 is redirected to  
[http://www.domain.com/users/1](http://www.domain.com/users/1)

So yeah, just curious what other people think about this issue.

---

<div class="post-metadata">

**Author:** ![captaffy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f04885/32.png) [@captaffy](https://www.ruby-forum.com/u/captaffy)\
**Post date:** [March 2, 2007, 4:36pm UTC](https://www.ruby-forum.com/t/rest-and-limiting-access/87403/2 "2007-03-02T16:36:36Z")

</div>

As you alluded to, in all my controllers I have a before\_filter that  
verifies and pre-populates instance variables of the main object(s) in  
the  
page. If you’re using AAA, you can just access ‘current\_user’ object  
which  
should always be the logged in user, alleviating the issue of forgery.  
This  
renders the user id in the URL uneccessary altogether. If you’re not  
using  
AAA, you can set a before\_filter such as:

def set\_user  
@user = User.find(session[:user\_id])  
end

So then in your update method, you would just do a  
@user.update\_attributes!(params).  
As for other controllers, it’s good to ensure the association isn’t  
forged  
as well. So in, say, an AssetsController you could have a before\_filter  
like:

def set\_variables  
@user = User.find(session[:user\_id])  
@asset = @user.assets.find(params[:id])  
end

hope that helps,

ed