Correcting invalid Resource Routes in Rails

Question

One thing I noticed when working with nested resource routes in Rails is that it is technically possible for a user to visit a route where the child resource exists (and is therefore displayed correctly), but the id for the parent resource represents an object that is not actually related to the child resource.

For example, in the route users/:user_id/post/:id, the user could type in a route where :user_id represents a user who did not make the post corresponding to :id.

What would be the best way to fix this so that if the user visits an invalid URL, the server redirects the user to the correct URL?

I have already put some code in my controllers to handle this, but it's kind of awkward having to check the path in every controller action and then redirect the user to the appropriate url, especially since the URL helpers are different for every action.

(edit_user_post_path(@user, @post), new_user_post_path(@user, @post))

There has to be a better way, right?

Chris Peters · Accepted Answer · 2013-05-21T10:19:22.727

You should have a before_filter running on all requests that makes sure the user is valid. If not, it will throw ActiveRecord::RecordNotFound and show the friendly 404 page.

Then grab the post based on the user however you need, whether in another before_filter or directly in the action. Base your post search on the user. My example below demonstrates doing this with another before_filter.

before_filter :find_user_by_user_id
before_filter :find_post

def show
  # Use @post variable here however you need
end

private

def find_user_by_user_id
  @user = User.find(params[:user_id])
end

def find_post
  # This assumes you have an association set up as needed
  @post = @user.posts.where(id: params[:id]).first

  if @post.nil?
    # Do whatever you need here
  end
end

Ah, I see. If I search for the post within the scope of the user's posts only, I won't have this problem. Up to this point, I'd been searching for the posts separately. E.g. `Posts.find(params[:id])` — Ajedi32, Aug 08 '12 at 18:12

score 0 · Answer 2 · answered Aug 08 '12 at 14:25

0

First of all you should know that the error wich is raised by ROR will display the message 'Sorry but the page you are looking for does not exist' on a production environment.

Therefor I would not be concerned about that. if you want to 'capture' the failure and quickly redirect to a safe area you might be interested in using the rescue method.

http://www.simonecarletti.com/blog/2009/12/inside-ruby-on-rails-rescuable-and-rescue_from/

have fun

answered Aug 08 '12 at 14:25

dennis

2,000
18
26

But what triggers the error? Does Rails automatically check that the parent resource is correct and react accordingly? Note that in my example, `Post.find(params[:id])` would return a valid post, and `User.find(params[:user_id])` would be valid as well, but `User.find(params[:user_id]).posts.include?(Post.find(params[:id]))` and `Post.find(params[:id]).user == User.find(params[:user_id])` would both be false. – Ajedi32 Aug 08 '12 at 14:31
The error is triggered by a returned NilClass in the relationship. when you are trying to find a resources with an id lets say user and as a nested resource his posts you will be returned an array. once you choose to seperate a specific post from the array in the show action using params[:id] it will search the array for the id when it can't be found it returns nil and renders the 404 output. – dennis Aug 08 '12 at 14:35
So... it saves the array of resources from the index action and checks it against the resource returned in the show action? I'm confused... FYI, in my development environment no error is returned at all when I give a route like the one in my example. – Ajedi32 Aug 08 '12 at 14:40
It matches The submitted resource with the earlier submitted relation resource(s). the reason you are not getting an error on dev is because you have set config.consider_all_requests_local = true in your development.rb if set to false it will render a user friendly output(404) – dennis Aug 08 '12 at 14:55
That's odd. I changed the variable you mentioned and it still isn't giving me any errors. (Except when the parent resource doesn't exist at all.) Maybe you aren't understanding the situation, here's an example: The user somehow ends up visiting `users/3/posts/5`. The controller runs `@user = User.find(3)` and `@post = Post.find(5)`. Both @user and @post were found and return valid ActiveRecord objects. What part of Rails then checks that `@user.posts.include?(@post)` is true and throws an exception if it isn't? – Ajedi32 Aug 08 '12 at 15:21

Correcting invalid Resource Routes in Rails

2 Answers2