# Securing using model finder?

**URL:** <https://www.ruby-forum.com/t/securing-using-model-finder/128635>\
**Category:** Rails\
**Created:** [February 9, 2008, 5:58pm UTC](https://www.ruby-forum.com/t/securing-using-model-finder/128635 "2008-02-09T17:58:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![marksta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/919ad9/32.png) [@marksta](https://www.ruby-forum.com/u/marksta)\
**Post date:** [February 9, 2008, 5:58pm UTC](https://www.ruby-forum.com/t/securing-using-model-finder/128635/1 "2008-02-09T17:58:20Z")

</div>

Dear rails user

I’ve just spent serveral hours getting to know the authentication  
plugins like “act as authenticated”, “model based security” etc.

Now I’m wondering why none of the existing plugins use a model based  
finder approach? My idea:

Overwrite the finder of each model to deliver only the allowed  
records.

As I always use MyModel.find(all) or MyModel.find(4) etc. the model  
MyModel would always be secured, no matter what I’d like to do… lets  
say destroy or edit.

But because none of the other plugins use this idea, I’m quite  
suspicious that I overlook a huge drawback.

Can anybody of you tell me what I miss? Thanks!

Best regards  
Markus