Empresas
Empleos
  • Sobre nosotros
  • Soluciones
    • Publicación de vacantes
      Publica tu vacante y recibe candidatos calificados en 48h.
    • Evaluación de candidatos
      500+ pruebas técnicas y psicológicas, más anti-fraude.
    • Headhunting
      Búsqueda ejecutiva a la medida de principio a fin.
    • Nómina + EOR
      Dispersión de nómina y EOR en más de 15 países de LATAM.
  • Precios
  • Empleos

0

315
Vistas
How to hidden query-string in Rails

I wanna pass to a resource in a request for example

# Go to payment link
<%= link_to 'Payment', checkout_path(pricing: amount.id) %>

When I go to payment link the url path is the next:

  http://localhost:3000/checkout?pricing=amount_2aHUHuhdn23jnSJd

I'd like to hidden the query-string "pricing=amount_2aHUHuhdn23jnSJd" without have to used any gem

UPDATE QUESTION 31/12

This request is of type Get since I need to show the different prices to the user, that's why the parameter pass (pricing: amount.id)

<%= link_to 'Payment', checkout_path(pricing: amount.id) %>

get 'checkout', to: 'subscriptions#checkout'

I'd appreciate your time and your grain of sand

over 4 years ago · Santiago Trujillo
3 Respuestas
Responde la pregunta

0

When the value is sensitive then hiding the value doesn't really fix the problem. Instead, I would suggest encrypting the value in the URL or to use another non-sensitive value instead.

  1. Value encryption

You could use Rails MessageEncryptor to encrypt the value before passing it to the URL and decrypt it later in the controller again.

# in app/models/url_encrypter.rb
module URLEncrypter
  ENCRYPTER = ActiveRecord::MessageEncryptor.new(
    Rails.application.secrets.secret_key_base.first(32)
  )

  def encrypt(value)
    ENCRYPTOR.encrypt_and_sign(value, purpose: :url)
  end

  def decrypt(value)
    ENCRYPTOR.decrypt_and_verify(value, purpose: :url)
  end
end

# when building the URL
<%= link_to 'Payment', checkout_path(pricing: URLEncrypter.encyrpt(amount.id)) %>

# when reading the param in the controller
pricing = URLEncrypter.decyrpt(params[:pricing])
amount = Amount.find(pricing)
  1. Have a second non-sensitive, unique identifier

Here you add a second unique identifier to your database table, for example, a column named uuid which you could populate automatically in a before_save callback with self.uuid = SecureRandom.uuid

You can then use its value instead of the id like this:

# when building the URL
<%= link_to 'Payment', checkout_path(pricing: amount.uuid) %>

# when reading the param in the controller
amount = Amount.find_by(uuid: params[:pricing])
over 4 years ago · Santiago Trujillo Denunciar

0

You could store it in the Session.

Store it when the user enters the page, clear it when user clicks a link.

# SomeController#before_payment
session[:pricing] = amount.id

#then..

# CheckoutController#index
pricing = session[:pricing]
session[:pricing] = nil

Be careful because it will only live within the session. It will be stored as a cookie, and have a 4kb limit for data.

over 4 years ago · Santiago Trujillo Denunciar

0

I'm not quite sure what you mean without seeing your routes.rb file. As mentioned by @Deepak Kumar to hide query from your url you should use POST request. Have a look at this guide. You can add below

post 'payment', to: 'checkout#payment'

In your routes.rb. This will call Payment action from your CheckoutsController

over 4 years ago · Santiago Trujillo Denunciar
Responde la pregunta
Encuentra empleos remotos

¡Descubre la nueva forma de encontrar empleo!

Top de empleos
Top categorías de empleo
Empresas
Publicar vacante Precios Comercial
Legal
Términos y condiciones Política de privacidad
© 2026 PeakU Inc. All Rights Reserved.
Andres GPT
Recomiéndame algunas ofertas
Necesito ayuda