Re: [OT] Not everything goes well in Ruby land :-)

>>  I always expose _encrypted_ primary keys in my URLs, so that  
>> people can't generalize:
>>
>> 10000001
>> 10000002
>> 10000003
>>
>> etc.
>
>
> But why?  I am not a big fan of security though obscurity.  If there  
> are security issues, you need to check the permission to view (as  
> you note below).  If there are no security issues (say items in a  
> catalog), what does it matter?
>
>
>> There's a method in Wonder that makes this easy.
>>
>>  After that, since URLs are always in the browser history anyways,  
>> for things that have to be secure, I have a method that takes the  
>> encrypted primary key, a key path, and session.user and makes sure  
>> that if you follow the specified key path from the object pointed  
>> at by the encrypted primary key, that you reach session.user.


  Because not everything can always be tied to a user, and encryption  
is not just obscurity.

  Another advantage of encryption is that its nice to get a failure if  
URLs have been truncated in the middle of the primary key. Something  
you might not get if both 1000 and 10001 are legitimate primary keys.

  Encryption functions actually make really good checksum/validation  
tools...

  Pierce