4 ms·

Security stuff aside, I'm curious why a system would be designed this way. Surely (in most systems) all users have the same page for managing their account (eg:

Security stuff aside, I'm curious why a system would be designed this way. Surely (in most systems) all users have the same page for managing their account (eg: /account) or is this system designed so that the management portion (eg: what a support person would use) is the same as what the users use? I don't think I've encountered a site that had accounts edited this way before.

adgar2 14y ago
> I don't think I've encountered a site that had accounts edited this way before. Any site that employs the pattern of specifying user account routes using the user's primary key in the URL needs to implement authorization. This site clearly skipped that step. To me, this looks like the stereotypical bare-bones rails deployment by a newbie.
natrius 14y ago
The last time I used Rails (2009), the way RESTful URLs are set up encouraged this pattern. It's simple enough to restrict access to the user in question, but it is (or was) easy to overlook.
- misiti3780 14y ago
  i agree - i cant think of a reason why the user id would ever be in the account url
  - grey-area 14y ago
    It's relatively common practice to have an url like this: /yourusername or /users/yourname or /users/32, which shows a public profile, and therefore to have a guessable url for it, and to have a link to edit your account on that page if you are that user. That in itself is not a security problem, but having no access control obviously is.
- ExpiredLink 14y ago
  It's REST, it must be good.
notatoad 14y ago
don't confuse the URL structure with the application design. just because the url is /user/87/edit doesn't mean that there is a file called edit inside a folder called 87. almost any modern web development framework lets you create whatever URLs you want. i'm sure, internally, that every user's edit panel is powered by the same code.
- 0r3jq4a0j 14y ago
  It's a Rails application and it does reflect the structure. It's the edit action on a controller, likely the UsersController. It looks like they tried to implement a user management system using has_secure_password and didn't know enough to do it properly. They therefore created a default resource structure (probably using the rails scaffold generator command) which includes the id in the URL on all member routes, including the route for the edit action.

adgar2 14y ago

> I don't think I've encountered a site that had accounts edited this way before. Any site that employs the pattern of specifying user account routes using the user's primary key in the URL needs to implement authorization. This site clearly skipped that step. To me, this looks like the stereotypical bare-bones rails deployment by a newbie.

natrius 14y ago

The last time I used Rails (2009), the way RESTful URLs are set up encouraged this pattern. It's simple enough to restrict access to the user in question, but it is (or was) easy to overlook.

misiti3780 14y ago
i agree - i cant think of a reason why the user id would ever be in the account url
- grey-area 14y ago
  It's relatively common practice to have an url like this: /yourusername or /users/yourname or /users/32, which shows a public profile, and therefore to have a guessable url for it, and to have a link to edit your account on that page if you are that user. That in itself is not a security problem, but having no access control obviously is.
ExpiredLink 14y ago
It's REST, it must be good.

notatoad 14y ago

don't confuse the URL structure with the application design. just because the url is /user/87/edit doesn't mean that there is a file called edit inside a folder called 87. almost any modern web development framework lets you create whatever URLs you want. i'm sure, internally, that every user's edit panel is powered by the same code.

0r3jq4a0j 14y ago
It's a Rails application and it does reflect the structure. It's the edit action on a controller, likely the UsersController. It looks like they tried to implement a user management system using has_secure_password and didn't know enough to do it properly. They therefore created a default resource structure (probably using the rails scaffold generator command) which includes the id in the URL on all member routes, including the route for the edit action.