rails3, params[:id] encryption

Question

I trying to prevent url hacking, I passing an id to the url that the forms need, it works fine but if the user changes that value on the url it will send values to the wrong table.

<%= link_to '+ New Event', {:controller =>'events', :action => 'new', :company_id => company.id} %>

On the php world I used to encrypt that id ...how can I do this on rails3 or is there a better way ??

needless to say I sort of new to rails and I know a little bit of php any help or suggestions will be greatly appreciated.

Answer 1

Rather than trying to encrypt or hide your company.id value, ask yourself what exactly it is that you want to prevent users from doing.

If you just want to prevent users from creating events associated with non-existant companies (by setting the id to a really high value for instance), then a simple

validates_presence_of :company

On the Event model would be fine.

If you only want users to be able to create events associated with companies that they work for, or have access for in some way, then you should create custom validations to verify that.

F

Answer 2

Even though this is an older question, it's a very worthwhile question. It is absolutely worthwhile to conceal the ID in the URL for, among other things, prevention of information disclosure.

For example, an application has a robust security model allowing users to only view resources to which they have rights. However, why should a user be able to look at the value of the ID in the URL and use it to deduce how many resources there are or, as the original questioner suggests, start trying to poke around with forced browsing.

The solution to this in rails turns out to be pretty simple. What I find works best is overriding to_param in the models, usually via a module in the lib directory and a before_filter in the application controller that decrypts the IDs.

For a walkthrough, have a look at this: http://www.youtube.com/watch?v=UW_s9ejrCsI