Encrypting Parameters accross controllers

Question

I need to pass a parameter from one method in a controller to another. From my understanding I have to pass the parameters as a GET exposing it in the url string. What is the best way to encrypt the data so no one can see what is actually getting passed in the string? Also, is there a way to pass it via POST or is my original understanding correct?

Answer 1

I haven't used RoR, but in the web world, this problem is solved with sessions. Using sessions you can store the parameters on the server and avoid sending sensitive data with GET or POST (both are insecure).

The Ruby on Rails Security Guide looks like a great read related to this.

Answer 2

I suggest you abstract your code into lib/ so that you don't have to call additional methods. Instead of making a new HTTP request, just put the code in a central place and call it from there.

class MyController < ApplicationController
  def index
    MyLibrary::Thing.do_stuff
  end

  def show
    MyLibrary::Thing.do_stuff
  end
end

# lib/my_library/thing.rb
module MyLibrary
  module Thing
    def self.do_stuff
      # do stuff!
    end
  end
end

That way you can access the same code in multiple actions, without doing extra HTTP requests.