Archive for December, 2007

Next Entries »

Protect your XHR actions (RoR)

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading ... Loading ...
Wednesday, December 5th, 2007

Using XHR within Ruby on Rails is as easy as adding up 1 and 1. We use e.g. the link_to_remote helper and point it to a controllers action. The small problem here is that the XHR actions are all available publicly. So calling the action directly within the browser works as well. I say ’small’ problem because we cannot really prevent calling them directly but we can narrow the access only to XHR calls. We want to achieve that a common request to an XHR will fail. XHR actions will only be available if the request itself is an xhr?.

The solution with a bit of Rubyism: every xhr action needs to be postfixed with _xhr. If a calling request is not an xhr then we redirect the user the home url. For this we add a simple before_filter within our ApplicationController which will check all out actions. Here is the snippet… (more…)

Posted in Ruby on Rails | No Comments »

Ruby on Rails: Protect params from injection

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading ... Loading ...
Wednesday, December 5th, 2007

Using the ActionControllers params method directly within your models can be very risky. You know doing this: User.new(params[:user]). Someone could easily create his own form adding additional parameters and therefore updating your model without your knowledge. The reason is clear: you take all available attributes with params. This article shows some solutions to protect your forms against such injections. (more…)

Posted in Ruby on Rails | No Comments »

Next Entries »