Question

I’m currently building an invite model that sends out email invitations with a link. The links are ‘secured’ with a sha1 hash. However, the controller fails to verify the hash and I can’t figure out why…

Generated links look like

/projects/1/invitations/12?hash=c043b70c359a85e20cd9933c9cd37ef3f8943d7b

and the controller tries to verify them with

def show
    @invitation = Invitation.find(params[:id])
    if @invitation.hash.to_s != params[:hash].to_s
       redirect_to root_url
       ....

The string comparison fails every time. I’ve triple checked, but the strings seem perfectly identical.

EDIT: Some debugging information

logger.debug params
logger.debug @invitation.hash

results in the following output in the development.log

{"hash"=>"c043b70c359a85e20cd9933c9cd37ef3f8943d7b", "action"=>"show",
controller"=>"invitations", "project_id"=>"1", "id"=>"12"}
c043b70c359a85e20cd9933c9cd37ef3f8943d7b

Answer 1

See if @invitation.hash is not actually calling Object#hash.