wbotelhos / idy

:eyeglasses: An ID obfuscator for ActiveRecord

Idy

An ID obfuscator for ActiveRecord.

Description

Do not let your users knows about your IDs:

• IDs can make hacker's life easier for a sequential attack;
• IDs can make crawler's life easier for a sequential scan;
• With few records on your database it can seem that your business is weak;
• With many records on your database it can call attention of people.

Make it clean, make it lean, make it hidden.

http://example.com/articles/1 -> http://example.com/articles/My

It uses Hashids to make it pretty.

install

Add the following code on your Gemfile and run bundle install:

gem 'idy'

Usage

On an ActiveRecord model, just add idy callback:

class Article < ApplicationRecord
  idy
end

Try to call on your model the obfuscated ID:

Article.new(id: 1).idy
# My

It will build your Rails URL with that ID too:

Article.new(id: 1).to_param
# localhost:3000/articles/My

Security

Idy is not for encryption, it is about obfuscation. If you want a unbreakable hash, it is not for you.

Collision

To avoid two differents models to generates the same hash for the same ID, by default, the class name is used as a Salt.

Article.new(id: 1).idy
# My

User.new(id: 1).idy
# ex

Salt

You can provide you own:

class Article < ApplicationRecord
  idy salt: 's3cr3t'
end

Article.new(id: 1).idy
# 9A

Idy

As you could see, the method idy, returns the hash representation of your ID:

Article.new(id: 1).idy
# My

If you want get all idys from a collection, just map it:

Article.create
Article.create

Article.select(:id).map(&:idy)
# ["My", "aL"]

Find

Since you add the idy callback to your model, find method will be decorated:

Article.find('My').id
# 1

Keep in mind that if you have some internal code, that you cannot change, using find, the hash version of the id, idy, will be mandatory to correct find the record.

Findy and Findy!

We encourage you to use this methods and avoid tweak find Rails method. As you expect, it will find directly via idy, so a normal integer will be not found, even if it exists on database.

Findy

The bumpless version returns nil when record is not found.

Article.findy('My').id
# 1

Article.findy 'missing'
# nil

Findy!

The bump ! version raises an error when record is not found.

Article.findy!('My').id
# 1

Article.findy! 'missing'
# ActiveRecord::RecordNotFound: Couldn't find Article with 'idy'="missing"

Functions

You can encode a number manually:

Model.idy_encode(idy)

You can decode an idy in case you want to use the ActiveRecord methods with the original ID:

Model.idy_decode(idy)

Testing

Check if your model responds to idy method:

RSpec

it { is_expected.to respond_to(:idy) }

Inspiration

It was inspired and improved from:

• obfuscate_id
• hashids_uri

idy's Issues

Different results with find vs findy

Hi again @wbotelhos! As I was playing with the library, I noticed a weird mismatch of results when using find and findy:

10] pry(main)> Individual.find('2R')
  Individual Load (0.5ms)  SELECT  "individuals".* FROM "individuals" WHERE "individuals"."id" = $1 LIMIT $2  [["id", 2], ["LIMIT", 1]]
=> #<Individual:0x00007f9b2be7d6c8
 id: 2,
 first_name: "The Aga",
 last_name: nil,
 created_at: Mon, 05 Feb 2018 19:41:12 PST -08:00,
 updated_at: Mon, 05 Feb 2018 19:41:12 PST -08:00>

[14] pry(main)> Individual.findy('2R')
  Individual Load (2.0ms)  SELECT  "individuals".* FROM "individuals" WHERE "individuals"."id" = $1 LIMIT $2  [["id", 1], ["LIMIT", 1]]
=> #<Individual:0x00007f9b31ace530
 id: 1,
 first_name: "First",
 last_name: "Person",
 created_at: Mon, 25 Dec 2017 08:34:34 PST -08:00,
 updated_at: Mon, 25 Dec 2017 08:34:34 PST -08:00>

According to the README, since the Individual model is decorated, I'd expect the same result - is my understanding correct?

When the idy is integer it is not detected as idy

#Sometimes hashids returns a hash which looks like an integer, and so the find function thinks it's a regular id resulting in a false 404

Test example

Can you add it on README?

Testing

Check if your model responds to idy method:

RSpec

it { is_expected.to respond_to(:idy) }

Thanks!

Clarifying usage with associations

Hi @wbotelhos, thank you for creating this library! In my setup, I have a Rails API server with a separate client and often have request of the following nature

# Create Book
book: {
  author_id: 382nfkjs,
  name: "The Dummy's guide to Obfuscating Ids"
}

Assuming in this case that both Book and Author model are using idy, can I pass in the idy-ed author_id or do I have to first convert it back to a non-obfuscated id?

Another version of the same problem is when serializing the book object, by default, any serializer would insert the database author_id. Is there a way to ensure that the obfuscated id is inserted? Or do I have to do something like this?

# Book
def get_author_id
  self.author.to_param.id
end

Thank you!