Re: [OT] Not everything goes well in Ruby land :-)

On Jan 7, 2008, at 2:10 PM, Pierce T. Wetter III wrote:

>
>>  What do you think? What are the goods and the bads of exposing  
>> PKs in URLs?
>
>   It depends on what they look like.
>
>   I always expose _encrypted_ primary keys in my URLs, so that  
> people can't generalize:
>
>  10000001
>  10000002
>  10000003
>
>  etc.


But why?  I am not a big fan of security though obscurity.  If there  
are security issues, you need to check the permission to view (as you  
note below).  If there are no security issues (say items in a  
catalog), what does it matter?


> There's a method in Wonder that makes this easy.
>
>   After that, since URLs are always in the browser history anyways,  
> for things that have to be secure, I have a method that takes the  
> encrypted primary key, a key path, and session.user and makes sure  
> that if you follow the specified key path from the object pointed  
> at by the encrypted primary key, that you reach session.user.

Chuck

-- 

Practical WebObjects - for developers who want to increase their  
overall knowledge of WebObjects or who are trying to solve specific  
problems.
http://www.global-village.net/products/practical_webobjects