3 ms·
The last time I used Rails (2009), the way RESTful URLs are set up encouraged this pattern. It's simple enough to restrict access to the user in question, but i
by natrius 14y ago
The last time I used Rails (2009), the way RESTful URLs are set up encouraged this pattern. It's simple enough to restrict access to the user in question, but it is (or was) easy to overlook.
- misiti3780 14y agoi agree - i cant think of a reason why the user id would ever be in the account url
- grey-area 14y agoIt's relatively common practice to have an url like this: /yourusername or /users/yourname or /users/32, which shows a public profile, and therefore to have a guessable url for it, and to have a link to edit your account on that page if you are that user. That in itself is not a security problem, but having no access control obviously is.
- ExpiredLink 14y agoIt's REST, it must be good.