Re: [OT] Not everything goes well in Ruby land :-)

On Jan 7, 2008, at 1:52 PM, Mike Schrag wrote:

>>  What do you think? What are the goods and the bads of exposing  
>> PKs in URLs?
> The only issue as far as I'm concerned is security.  I don't care  
> if anyone sees PK's, but exposing access to arbitrary EO's via a  
> URL means that the onus of security is much more on the developer's  
> shoulders.

True, but exposing a PK or some other unique value seems equally  
dangerous to me.  I have heard people claim the evils of giving the  
PK meaning by using it in this manner.  I see this as more of an  
academic than a practical concern.  Not using the PK (e.g. using some  
other manufactured, unique value) would allow you to swap in other  
objects for the same value, but I have never seen where that was  
needed when there was not some other suitable unique value (e.g. a  
part number).



> With normal component actions, there's at least some level of  
> security built-in (that you are even able to access this action  
> means that you were pre-authorized to get to it by way of some  
> authentication process). Note, however, that this is really not all  
> that different than security of DA's in general (or even direct  
> access to any .wo that has intrinsic state).


Yes, you need to be extra vigilant when using these.

Chuck

-- 

Practical WebObjects - for developers who want to increase their  
overall knowledge of WebObjects or who are trying to solve specific  
problems.
http://www.global-village.net/products/practical_webobjects