Hello Dale,
We're close to launching our application to the public. Although this
will be a closed alpha I'm still kind of concerned about the security
of using an incrementing integer for the id to sensitive database
records.
[snip]
@blog = Blog.find(:first, :conditions => ['id = ? and user_id = ?',
params:[blog][:id], session[:user_id]])
How do you handle user authentication and login? If you were to use the restful_auth plugin for example, which assigns a current_user to every controller (or current_whateveryoucalledyourusermodel), then you can use associations in your User model like so:
class User < ActiveRecord::Base
has_many :blogs
# lots more stuff here from the restful_auth plugin if you used it
end
Then you can do in your controllers:
@blog = current_user.blogs.find(:first)
...and so on, in every place you access user specific data. You can wrap most of this in a before_filter so that user related data are loaded at the start of each controller method, or when needed.
Even if you don't use the restful_auth plugin, you can add a line like this to your application.rb
before_filter {|cntrlr| cntrlr.user = User.find(session[:user_id]) }
The above line assigns the current authenticate user object to all controllers before any actions are called. That way in your controller you have always available the @user with the current authenticated user and you can do:
@blog = @user.blogs.find(:first)
If someone tried to do a http://localhost/blogs/show/1 your show action with the above line would not find the record if it does not belong to the user.
but is it enough? Does anyone have some opinion about this?
I'd say your own method is sufficient, but not quite 'The Rails Way'. Use associations, and plugins like above to make your code easier to read and maintain.
-christos
