Skip to content
👓 An ID obfuscator for ActiveRecord
Ruby
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
lib
spec
.gitignore
.rubocop.yml
.rubocop_todo.yml
.ruby-gemset
.ruby-version rb: 2.6.4 Oct 3, 2019
.travis.yml
CHANGELOG.md
Gemfile
Gemfile.lock
LICENSE
README.md
Rakefile
idy.gemspec

README.md

Idy

Build Status Gem Version

An ID obfuscator for ActiveRecord.

Description

Do not let your users knows about your IDs:

  • IDs can make hacker's life easier for a sequential attack;
  • IDs can make crawler's life easier for a sequential scan;
  • With few records on your database it can seem that your business is weak;
  • With many records on your database it can call attention of people.

Make it clean, make it lean, make it hidden.

http://example.com/articles/1 -> http://example.com/articles/My

It uses Hashids to make it pretty.

install

Add the following code on your Gemfile and run bundle install:

gem 'idy'

Usage

On an ActiveRecord model, just add idy callback:

class Article < ApplicationRecord
  idy
end

Try to call on your model the obfuscated ID:

Article.new(id: 1).idy
# My

It will build your Rails URL with that ID too:

Article.new(id: 1).to_param
# localhost:3000/articles/My

Security

Idy is not for encryption, it is about obfuscation. If you want a unbreakable hash, it is not for you.

Collision

To avoid two differents models to generates the same hash for the same ID, by default, the class name is used as a Salt.

Article.new(id: 1).idy
# My

User.new(id: 1).idy
# ex

Salt

You can provide you own:

class Article < ApplicationRecord
  idy salt: 's3cr3t'
end
Article.new(id: 1).idy
# 9A

Idy

As you could see, the method idy, returns the hash representation of your ID:

Article.new(id: 1).idy
# My

If you want get all idys from a collection, just map it:

Article.create
Article.create

Article.select(:id).map(&:idy)
# ["My", "aL"]

Find

Since you add the idy callback to your model, find method will be decorated:

Article.find('My').id
# 1

Keep in mind that if you have some internal code, that you cannot change, using find, the hash version of the id, idy, will be mandatory to correct find the record.

Findy and Findy!

We encourage you to use this methods and avoid tweak find Rails method. As you expect, it will find directly via idy, so a normal integer will be not found, even if it exists on database.

Findy

The bumpless version returns nil when record is not found.

Article.findy('My').id
# 1

Article.findy 'missing'
# nil

Findy!

The bump ! version raises an error when record is not found.

Article.findy!('My').id
# 1

Article.findy! 'missing'
# ActiveRecord::RecordNotFound: Couldn't find Article with 'idy'="missing"

Inspiration

It was inpired and improved from:

Love it!

Via PayPal or Gratipay. Thanks! (:

You can’t perform that action at this time.