Question

I’m fairly new to RoR I have a controller and within that controller I need to store an instance variable I create in the new method and reference it again in the create method.

Now because HTTP is stateless the only reasonable way I have found to do this is store the id of the model that the instance variable contains in session[] and then recall this value from session[] again in the create method. I’m just concerned about security using this way of storing the variable’s id, I need to make sure that a user can’t change the value of what I’ve stored in session[]

Is there a better way for me to do this? Is it safe? Or should I try something else?

Answer 1

If you can’t recalculate that model id on every request, using a session is ok.
Here’s more info on session security in Rails.