# Secure Form question **URL:** \ **Category:** Rails\ **Created:** [August 19, 2009, 11:48am UTC](https://www.ruby-forum.com/t/secure-form-question/174012 "2009-08-19T11:48:22Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Trausti\_Thor\_J](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5daacb/32.png) [@Trausti\_Thor\_J](https://www.ruby-forum.com/u/Trausti_Thor_J)\ **Post date:** [August 19, 2009, 11:48am UTC](https://www.ruby-forum.com/t/secure-form-question/174012/1 "2009-08-19T11:48:22Z")
In cakephp, you have Secure component. It takes certain form values like id and User\_id and such and encodes them. How is this done in rails ? I don’t want the user to change ids on items for deletions and such. Trausti ---
**Author:** ![Trausti\_Thor\_J](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5daacb/32.png) [@Trausti\_Thor\_J](https://www.ruby-forum.com/u/Trausti_Thor_J)\ **Post date:** [August 19, 2009, 1:08pm UTC](https://www.ruby-forum.com/t/secure-form-question/174012/2 "2009-08-19T13:08:34Z")
You can enable the :protect\_from\_forgery which puts in an authenticity token with every form. This is on by default in the new version of Rails. This is a random ID tied down with the session. This is not the same as what you are looking for, but it will probably suffice. On Aug 19, 2:47 pm, Trausti Thor J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![Trausti\_Thor\_J](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5daacb/32.png) [@Trausti\_Thor\_J](https://www.ruby-forum.com/u/Trausti_Thor_J)\ **Post date:** [August 19, 2009, 1:33pm UTC](https://www.ruby-forum.com/t/secure-form-question/174012/3 "2009-08-19T13:33:45Z")
On Aug 19, 12:07 pm, Mukund [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > You can enable the :protect\_from\_forgery which puts in an authenticity > token with every form. This is on by default in the new version of > Rails. This is a random ID tied down with the session. This is not > the same as what you are looking for, but it will probably suffice. Actually i think it is completely different. That is protection from csrf attacts, whereas Trausti is (I think) concerned about a user editing the page to change the value of a hidden field or things like that. Fred ---
**Author:** ![Trausti\_Thor\_J](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5daacb/32.png) [@Trausti\_Thor\_J](https://www.ruby-forum.com/u/Trausti_Thor_J)\ **Post date:** [August 19, 2009, 1:44pm UTC](https://www.ruby-forum.com/t/secure-form-question/174012/4 "2009-08-19T13:44:52Z")
You could always do it manually by encoding the ids in questions and storing the encoding in the form as well. On form validation, you could just ensure that the encoded string and the non-encoded string match up. That way, a hacker would need to change both strings to get the thing to work. Would that work or were you looking for something less manual like a gem or whatever? On Wed, Aug 19, 2009 at 7:32 AM, Frederick C. \< ---
**Author:** ![Trausti\_Thor\_J](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5daacb/32.png) [@Trausti\_Thor\_J](https://www.ruby-forum.com/u/Trausti_Thor_J)\ **Post date:** [August 19, 2009, 7:30pm UTC](https://www.ruby-forum.com/t/secure-form-question/174012/5 "2009-08-19T19:30:16Z")
You may want to take a look at attr\_accessible / attr\_protected and friends - they handle the common case where you don’t want to allow mass-assignment of some attributes. –Matt J. On Aug 19, 7:32 am, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![Trausti\_Thor\_J](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/5daacb/32.png) [@Trausti\_Thor\_J](https://www.ruby-forum.com/u/Trausti_Thor_J)\ **Post date:** [August 19, 2009, 2:42pm UTC](https://www.ruby-forum.com/t/secure-form-question/174012/6 "2009-08-19T14:42:49Z")
Fredrik, exactly what I am after. Hashing/crypting the hidden fields. How ? If I do this manually, it is more than guaranteed that I will forget this someplace. Trausti On Wed, Aug 19, 2009 at 1:32 PM, Frederick