Closed yshmarov closed 9 months ago
Hey! Of the three (four?) what would you suggest as the simplest yet most effective improvement?
I think the best thing to do is always "use slugged session ids out of the box"
- /sign_in/:id_slug
- /sign_in/:id
Maybe that would mean adding an additional attribute to the session model like :slugged_id
and having Session.find_by(slugged_id: params[:id])
Maybe this could be added as an optional feature... 🤔
Separately, something like this would prevent being able to view screens for the "old" sessions:
-@session = Session.find(params[:id])
+@session = Session.not_expired.not_claimed.find(params[:id])
Could we just use uuids for the slugs? Alternatively: Should the table default to uuids for primary keys instead?
Alternatively: Should the table default to uuids for primary keys instead?
Yesss! I think uuids are an even better idea!
Thank you for your help @yshmarov! 💙💛
Currently, after claiming a session it is still possible to navigate to the claimed session URL like http://localhost:3000/sign_in/3.
It is also possible to navigate to something like http://localhost:3000/sign_in/334534543abc and get an error like
Thus, a user can find how many sessions there were.
I would suggest:
Also I think
sign_in/:id
will be a good candidate for captcha / rate limiting in a production app 🤔