# URL faking with nested resources

**URL:** <https://www.ruby-forum.com/t/url-faking-with-nested-resources/132012>\
**Category:** Rails\
**Created:** [March 15, 2008, 7:28am UTC](https://www.ruby-forum.com/t/url-faking-with-nested-resources/132012 "2008-03-15T07:28:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike\_Y](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ba9def/32.png) [@Mike\_Y](https://www.ruby-forum.com/u/Mike_Y)\
**Post date:** [March 15, 2008, 7:28am UTC](https://www.ruby-forum.com/t/url-faking-with-nested-resources/132012/1 "2008-03-15T07:28:50Z")

</div>

I’ve created a three tiered nested resource tree as defined below. My  
problem is that it’s easy for a user to fake the URL and pull image  
records from another users account since there is no check to see if  
the image actually belongs to the user. Does anyone have a  
recommendation on how I can secure this in a DRY manner? Is there  
some sort of plugin or base functionality that I can’t seem to find by  
googling?

map.resources :people do |person|  
person.resources :events do |event|  
event.resources :images  
end  
end

For example, if a user types in the following url they will get the  
image whether or not the image is part of an event which belongs to  
the specified user:

[http://localhost/people/123/events/456/images/789](http://localhost/people/123/events/456/images/789)

Thanks,

Mike

---

<div class="post-metadata">

**Author:** ![Mike\_Y](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ba9def/32.png) [@Mike\_Y](https://www.ruby-forum.com/u/Mike_Y)\
**Post date:** [March 15, 2008, 8:04am UTC](https://www.ruby-forum.com/t/url-faking-with-nested-resources/132012/2 "2008-03-15T08:04:00Z")

</div>

On Mar 14, 2008, at 11:28 PM, Mike Y wrote:

> ```
> event.resources :images
> 
> ```
> 
> Mike

It seems that if you authenticate your user (probably your person),  
then you can safely assume ownership of events and images. So using  
your example, the ImagesController will be in charge of serving this  
page. This might translate to:

{:controller =\> ‘images’, :id =\> 789, :event\_id=\> 456, :person\_id =\>  
123}

Thus, you might write code in your controller such as:

if Session.user\_authenticated(params[:person\_id])  
image =  
Person  
.find  
(params  
[:person\_id]).events.find(params[:event\_id]).images.find(params[:id])  
else  
flash[:error] = ‘go steal images someplace else’  
end

The “user\_authenticated” method might be something you would add to  
RESTful Authentication to compare the params[:person\_id] to the id of  
the current user.

---

<div class="post-metadata">

**Author:** ![Mike\_Y](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ba9def/32.png) [@Mike\_Y](https://www.ruby-forum.com/u/Mike_Y)\
**Post date:** [March 15, 2008, 9:10am UTC](https://www.ruby-forum.com/t/url-faking-with-nested-resources/132012/3 "2008-03-15T09:10:14Z")

</div>

you might want to read the following about nesting resources more than  
2 levels deep: [Buckblog: Nesting resources](http://weblog.jamisbuck.org/2007/2/5/nesting-resources)

having said that, the normal way to do this is by scoping to the  
specified resource:

class EventsController \< ApplicationController

before\_filter :get\_person

def get\_person  
@person = People.find\_by\_id(params[:person\_id])  
end

def index  
@events = @person.events  
end

def edit  
@event = @person.events.find\_by\_id(params[:id])  
…  
end

Mike