# Unique URLs for authentication

**URL:** <https://www.ruby-forum.com/t/unique-urls-for-authentication/157776>\
**Category:** Rails\
**Created:** [January 15, 2009, 7:29am UTC](https://www.ruby-forum.com/t/unique-urls-for-authentication/157776 "2009-01-15T07:29:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dazonic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ba8739/32.png) [@dazonic](https://www.ruby-forum.com/u/dazonic)\
**Post date:** [January 15, 2009, 7:29am UTC](https://www.ruby-forum.com/t/unique-urls-for-authentication/157776/1 "2009-01-15T07:29:54Z")

</div>

I’ve set up a route like this

map.connect ‘confirm/:id/:full\_name/’, :controller =\> “users”, :action  
=\> “confirm”

and I’m wondering what is the best way to verify in the confirm method.

full\_name created in the model and it’s not in the database.

This doesn’t work because it doesn’t parse one, then the other…

if @user = User.find(params[:id]) && @user.full\_name ==  
params[:full\_name]

# cool

else

# bad

end

I want to do it the nice way, it doesn’t seem right to nest a whole heap  
of if statements. If you can help me out it’d be awesome, cheers!

---

<div class="post-metadata">

**Author:** ![dazonic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ba8739/32.png) [@dazonic](https://www.ruby-forum.com/u/dazonic)\
**Post date:** [January 15, 2009, 9:56am UTC](https://www.ruby-forum.com/t/unique-urls-for-authentication/157776/2 "2009-01-15T09:56:51Z")

</div>

Darren, a good design pattern that is useful for lots of models if  
you’re aiming for RESTfulness is to add a before\_filter to your  
controller. So, if I understood your question correctly:

class UsersController \< ApplicationController  
before\_filter :retrieve\_user

# Executed before every request if processed

def retrieve\_user  
@user = User.find(params[:id])  
end

def confirm  
if @user.full\_name == params[:full\_name]  
head :ok  
else  
head :bad\_request  
end  
end  
end

Cheers, --Kip

---

<div class="post-metadata">

**Author:** ![dazonic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ba8739/32.png) [@dazonic](https://www.ruby-forum.com/u/dazonic)\
**Post date:** [January 15, 2009, 10:02am UTC](https://www.ruby-forum.com/t/unique-urls-for-authentication/157776/3 "2009-01-15T10:02:45Z")

</div>

Should have explained a little further, just in case.

> > This doesn’t work because it doesn’t parse one, then the other…
> 
> > if @user = User.find(params[:id]) && @user.full\_name ==  
> > params[:full\_name]

Ruby will check the predicated of an ‘if’ statement in the order you  
type them  
and will therefore work as you expect. Except…

A Model.find(id) will raise an exception if the id isn’t found. This  
will, by default,  
cause Rails to send your 404 page (not found) which is pretty cool  
really.  
Because you don’t have to get fussed about worry about the case where  
the id  
is not found in your app logic.

Thats why the before\_filter I suggested works too. Your controller  
action  
code will only every get executed if the User.find(id) is successful  
and you  
just use the info retriieved.

Lastly, the pattern of /:controller/:id/:action is very common (and  
how  
RESTful resources work. Which means your before filter is going to be  
just  
as useful for your CRUD actions as well.

Cheers, --Kip

---

<div class="post-metadata">

**Author:** ![dazonic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/ba8739/32.png) [@dazonic](https://www.ruby-forum.com/u/dazonic)\
**Post date:** [January 15, 2009, 10:11am UTC](https://www.ruby-forum.com/t/unique-urls-for-authentication/157776/4 "2009-01-15T10:11:23Z")

</div>

Awesome, thanks buddy. I’m still learning ‘the rails way’. Good  
solution.