# REST Route how to avoid hacking routes **URL:** \ **Category:** Rails\ **Created:** [June 30, 2007, 7:34pm UTC](https://www.ruby-forum.com/t/rest-route-how-to-avoid-hacking-routes/108233 "2007-06-30T19:34:58Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\ **Post date:** [June 30, 2007, 7:34pm UTC](https://www.ruby-forum.com/t/rest-route-how-to-avoid-hacking-routes/108233/1 "2007-06-30T19:34:58Z")
what’s the best protection against someone trying to modify an URL in a named route /users/25/posts if the user enter another URL /users/26/posts, he can get acces to user 26 posts unless … a before\_filter is checking the current\_user ID but is there any other way to do it ? thanks for your lights kad ---
**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\ **Post date:** [June 30, 2007, 9:16pm UTC](https://www.ruby-forum.com/t/rest-route-how-to-avoid-hacking-routes/108233/2 "2007-06-30T21:16:57Z")
You shouldn’t ever rely on routing to protect information from being accessed or edited. Not what it’s for. If only the current user can access his or her posts, I’d probably create a route for that specifically, maybe something like: /posts /account/posts That way you just go off current\_user or session[:user] instead of user\_id. Otherwise, you definitely need a before\_filter. On Jun 30, 11:34 am, Kad K. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![kadoudal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f0a364/32.png) [@kadoudal](https://www.ruby-forum.com/u/kadoudal)\ **Post date:** [June 30, 2007, 11:08pm UTC](https://www.ruby-forum.com/t/rest-route-how-to-avoid-hacking-routes/108233/3 "2007-06-30T23:08:33Z")
pico wrote: > You shouldn’t ever rely on routing to protect information from being > accessed or edited. Not what it’s for. > > If only the current user can access his or her posts, I’d probably > create a route for that specifically, maybe something like: > > /posts > /account/posts > > That way you just go off current\_user or session[:user] instead of > user\_id. Otherwise, you definitely need a before\_filter. > > On Jun 30, 11:34 am, Kad K. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Thanks… I understand better… I’ve never written such routes yet (REST beginner…) I believe it’s only a matter of writting path without parameters