Skip to content

Conversation

@polypixeldev
Copy link
Member

Summary of the problem

Most of our hash IDs are currently able to be calculated by anyone, as most models do not use any salt when calculating the hash ID. This makes it so that hash IDs are only slightly more effective in preventing people from enumerating over all IDs for a resource than using plain numerical IDs.

We recently started adding salts to new models manually, but it is not currently the default for new models.

Describe your changes

Make using a hash ID salt the default for new models! This PR sets the salt configured in the environment variable as the default using an initializer, and then overrides that default to set an empty salt in existing models to not break existing links.

I also removed the inclusion of Hashid::Rails from the PublicIdentifiable concern, since it is not clear that PublicIdentifiable includes Hashid::Rails, and applying the empty salt override only needs to happen in existing models. (At the very least, the empty salt override needs to be in the invididual models - I think it's also clearer if we include Hashid::Rails in the individual models alongside PublicIdentifiable, however if the annoyance of forgetting to include Hashid::Rails alongside PublicIdentifiable is a bigger concern, that's fine too).

@polypixeldev polypixeldev requested a review from a team February 12, 2026 03:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant