# Security and incrementing integer ids

**URL:** <https://www.ruby-forum.com/t/security-and-incrementing-integer-ids/84825>\
**Category:** Rails\
**Created:** [February 8, 2007, 12:03am UTC](https://www.ruby-forum.com/t/security-and-incrementing-integer-ids/84825 "2007-02-08T00:03:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 8, 2007, 12:03am UTC](https://www.ruby-forum.com/t/security-and-incrementing-integer-ids/84825/1 "2007-02-08T00:03:58Z")

</div>

We’re close to launching our application to the public. Although this  
will be a closed alpha I’m still kind of concerned about the security  
of using an incrementing integer for the id to sensitive database  
records.  
I understand that these integer fields are ‘the rails way’ but I’m  
thinking about having all the sensitive ids replaced with UUIDs  
(GUIDs) but I’m not sure if this is really necessary. I’d rather not  
do this right before launch since we have a thousand other things to  
do that will be much more impressive, but securing users data is a  
very high priority for me.  
We are already pretty careful and rather than do something like this

…  
@blog = Blog.find(params[:id])  
…

we do

…  
@blog = Blog.find(:first, :conditions =\> [‘id = ? and user\_id = ?’,  
params:[blog][:id], session[:user\_id]])  
…

but is it enough?  
Does anyone have some opinion about this?

Dale

---

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 8, 2007, 1:14am UTC](https://www.ruby-forum.com/t/security-and-incrementing-integer-ids/84825/2 "2007-02-08T01:14:05Z")

</div>

> We are already pretty careful and rather than do something like this  
> …
> 
> but is it enough?  
> Does anyone have some opinion about this?

Well, I agree that simple numeric ID’s are easier to guess than a GUID,  
but GUID’s are easy to guess too as long as you try enough combinations  
🙂

My point being, that GUID’s only obscure the problem, don’t actually  
solve  
it. Solving it means that even if I know the ID’s associated with  
_your_  
user, I still can’t get to the data… and I’d say doing that through  
your  
second example is probably the right approach…

-philip

---

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 8, 2007, 1:50am UTC](https://www.ruby-forum.com/t/security-and-incrementing-integer-ids/84825/3 "2007-02-08T01:50:07Z")

</div>

Hello Dale,

> We’re close to launching our application to the public. Although this  
> will be a closed alpha I’m still kind of concerned about the security  
> of using an incrementing integer for the id to sensitive database  
> records.

[snip]

> @blog = Blog.find(:first, :conditions =\> [‘id = ? and user\_id = ?’,  
> params:[blog][:id], session[:user\_id]])

How do you handle user authentication and login? If you were to use  
the restful\_auth plugin for example, which assigns a current\_user to  
every controller (or current\_whateveryoucalledyourusermodel), then  
you can use associations in your User model like so:

class User \< ActiveRecord::Base  
has\_many :blogs  
# lots more stuff here from the restful\_auth plugin if you used it  
end

Then you can do in your controllers:

@blog = current\_user.blogs.find(:first)

…and so on, in every place you access user specific data. You can  
wrap most of this in a before\_filter so that user related data are  
loaded at the start of each controller method, or when needed.

Even if you don’t use the restful\_auth plugin, you can add a line  
like this to your application.rb

before\_filter {|cntrlr| cntrlr.user = User.find(session[:user\_id]) }

The above line assigns the current authenticate user object to all  
controllers before any actions are called. That way in your  
controller you have always available the @user with the current  
authenticated user and you can do:

@blog = @user.blogs.find(:first)

If someone tried to do a [http://localhost/blogs/show/1](http://localhost/blogs/show/1) your show  
action with the above line would not find the record if it does not  
belong to the user.

> but is it enough? Does anyone have some opinion about this?

I’d say your own method is sufficient, but not quite ‘The Rails Way’.  
Use associations, and plugins like above to make your code easier to  
read and maintain.

-christos

---

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 8, 2007, 1:51am UTC](https://www.ruby-forum.com/t/security-and-incrementing-integer-ids/84825/4 "2007-02-08T01:51:07Z")

</div>

> …
> 
> but is it enough?  
> Does anyone have some opinion about this?

Since you asked for an opinion… 🙂

The second approach is a step closer to secure when you add the user\_id  
restriction and that the user id is part of the session (you’re not  
passing  
it via the parameter). Since you have some data that is viewed by  
authenticated users, then maybe the controller action should be  
protected  
from the public.

It all depends on your application structure. If you have a use case  
for  
finding Blogs that are public and some that are private, then I would  
have  
two controllers a public one and a private one. For the private one,  
restrict access to the controller/action as well.

I’ve seen a few posts using the security approach of “allow all unless  
restricted”. I prefer the approach of “restrict all unless allowed”.

If you’re interested, I can send you my lockdown plugin with some  
instructions on how to use. I’ve never found the time to distribute it  
properly. Just email me directly (so my filters can pick it out). If  
you  
are interested, I can get it to you this weekend. Since it evolved over  
time, I’ve never taken the time to refactor it to a self contained  
plugin.  
There are a couple of classes in my /lib dir I’ll need to include.

It’s a lot easier to implement than I may have made it seem, but it’s  
not  
trivial. Security never is.

good luck,  
andy

---

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 8, 2007, 2:27am UTC](https://www.ruby-forum.com/t/security-and-incrementing-integer-ids/84825/5 "2007-02-08T02:27:11Z")

</div>

Andy,

Thanks, I will take a look at that if you don’t mind. I’m always  
looking for ways to make things more secure.  
You can just email it back to this address if that’s OK.

Dale

---

<div class="post-metadata">

**Author:** ![PeteSalty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bc79bd/32.png) [@PeteSalty](https://www.ruby-forum.com/u/PeteSalty)\
**Post date:** [February 8, 2007, 2:29am UTC](https://www.ruby-forum.com/t/security-and-incrementing-integer-ids/84825/6 "2007-02-08T02:29:11Z")

</div>

Christos,

Thanks for this idea, to be honest we didn’t know you could do that as  
we’re all a little junior on rails - always more to learn 🙂

Dale

On Feb 7, 4:49 pm, Christos Z. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)