# Secure but elegant destruction method

**URL:** <https://www.ruby-forum.com/t/secure-but-elegant-destruction-method/161336>\
**Category:** Rails\
**Created:** [February 25, 2009, 4:40pm UTC](https://www.ruby-forum.com/t/secure-but-elegant-destruction-method/161336 "2009-02-25T16:40:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vahagn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/cc9497/32.png) [@vahagn](https://www.ruby-forum.com/u/vahagn)\
**Post date:** [February 25, 2009, 4:40pm UTC](https://www.ruby-forum.com/t/secure-but-elegant-destruction-method/161336/1 "2009-02-25T16:40:51Z")

</div>

Hi,-

I am looking for a clean and secure way for an ActiveRecord instance to  
delete itself. Say I have a User model in my app. Then the destructive  
action would be /users/user\_id/destroy. If this action is not secured by  
a filter like:

(\*) before\_filter :check\_administrator\_role, :only =\> :destroy

then any user could potentially log in and start issuing:

/users/1/destroy  
/users/2/destroy  
.  
.  
.  
/users/n/destroy

But I want to give a User the possibility to delete [him|her]self.  
Currently the only way I can think of it is this:

1. Remove the filter (\*)
2. Re-code the destroy method so:  
def destroy  
@user = User.find(params[:id])  
if logged\_in\_user == @user or  
logged\_in\_user.has\_role?(‘administrator’)  
if @user.destroy  
flash[:notice] = “User deleted”  
else  
flash[:error] = “There was a problem deleting this user.”  
end  
redirect\_to :action =\> ‘index’  
end

But, is this the best way to do it?

Thanks in advance,  
Vahagn

---

<div class="post-metadata">

**Author:** ![vahagn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/cc9497/32.png) [@vahagn](https://www.ruby-forum.com/u/vahagn)\
**Post date:** [February 25, 2009, 5:02pm UTC](https://www.ruby-forum.com/t/secure-but-elegant-destruction-method/161336/2 "2009-02-25T17:02:25Z")

</div>

Sorry, the code should have been:

def destroy  
@user = User.find(params[:id])  
if @user == logged\_in\_user or  
logged\_in\_user.has\_role?(‘administrator’)  
if @user.destroy  
flash[:notice] = “User deleted”  
else  
flash[:error] = “There was a problem deleting this user.”  
end  
redirect\_to :action =\> ‘index’  
end  
end

/ V.

---

<div class="post-metadata">

**Author:** ![vahagn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/cc9497/32.png) [@vahagn](https://www.ruby-forum.com/u/vahagn)\
**Post date:** [February 26, 2009, 3:49am UTC](https://www.ruby-forum.com/t/secure-but-elegant-destruction-method/161336/3 "2009-02-26T03:49:10Z")

</div>

I don’t see anything wrong with this. I’d only resort to a filter if  
it was going to be used by multiple actions.

On Feb 25, 11:02 am, Vahagn H. \<rails-mailing-l…@andreas-

---

<div class="post-metadata">

**Author:** ![vahagn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/cc9497/32.png) [@vahagn](https://www.ruby-forum.com/u/vahagn)\
**Post date:** [February 26, 2009, 1:14pm UTC](https://www.ruby-forum.com/t/secure-but-elegant-destruction-method/161336/4 "2009-02-26T13:14:01Z")

</div>

Yeah - good point Jeff.

/ V.

Jeff Emminger wrote:

> I don’t see anything wrong with this. I’d only resort to a filter if  
> it was going to be used by multiple actions.
> 
> On Feb 25, 11:02�am, Vahagn H. \<rails-mailing-l…@andreas-