CODEWITHSUNDEEP
javaurlparametersplayframework
Jon R
Jon R

Reputation: 127

Java Play Framework Hidden Url Routes

Is it possible to hide/mask the urls in the java play framework. The problem I have come across is I want a user to be able to log in and view messages belonging to them but I do not want any old user to find theses messages by simply hacking the url.

What I have got is a Notifications controller which has a method called show(long id).

my route for this method is:

GET     /Message/Show               Notifications.show

i call the function using 

@Notifications.show(':id')

the url for this function is:

http://localhost:9000/Message/Show?id=8

Is it possible to remove the parameter off the end of the url so people can not hack into certain urls by guessing parameters.

Upvotes: 2

Views: 1727

Answers (4)

Jon R
Jon R

Reputation: 127

This is the approach I used, I do not know if this is the best way around this but it does work how I want it to.

Thanks for all the help and ideas. 

public static void show(long id)
    {
        Notification notification = Notification.findById(id);
        User connectedUser = User.find("byEmail", Security.connected()).first();

        if(notification.recipient.equals(connectedUser))
        {
            render(notification);
        }
        else
        {
            forbidden("This isnt your message stop hacking the urls!");     
        }
    }

Upvotes: 2

i.am.michiel
i.am.michiel

Reputation: 10404

Or you could log in the user and fetch only the users message.

Why search a complicate solution such as obfuscation/interceptions and whatever when a very simple solution exists. Use the session of the connected user, fetch only his messages and done.

Upvotes: 1

Tim Büthe
Tim Büthe

Reputation: 63814

If I got this right, you want to hide URLs so users don't know them and do not enter them. If they do, they would see content they shouldn't see. This is bad and should not be done this way, take a look at Security through obscurity (Wikipedia), use readable/bookmarkable URLs and build proper login and security mechanisms like leifg suggested.

Upvotes: 2

leifg
leifg

Reputation: 9028

This is something that can be achieved with Interceptions.

http://www.playframework.org/documentation/1.2.3/controllers#interceptions

Inside these classes you can check if the current user is logged in (store in session)

Upvotes: 5

Related Questions