flash[:notice] Security

rubyonrails-talk
1

Would it be possible for another website user to accidentally be served the flash[:notice] of another person? I may just redirect_to the final screen and reread the data back from the database, but thinking about all this made me wonder how secure flash[:notice] really is.

The flash is just a convenience gateway to the session. So if you trust the session, you'll trust the flash. And the session is simply just a unique md5 string in a cookie on the client that gets shot across on every request, which the server uses to find the session row/file with. It's not a highly complicated system, so if you wanted to dig in to do your own verification, it shouldn't be that onerous.

2

It's not a specially good idea to store AR objects in the session, as they may become outdated and so on. Preferrably, store the id, and define a controller method that finds the actual object.

If the saved data you want to show is an AR object, you may simply pass the id in the url and re-retrieve the record in the final screen, much simpler than relying on the flash.