Question

I’m writing a ruby on rails application using mongoid and I’m wondering about the security implications of storing users and admin users in the same document. My current implementation is using devise and kind of modeled on how activeadmin does it. The admin users are in a separate document so there isn’t any chance of someone escalating their privileges. This is a public facing site and there is some financial information involved.

But i’m curious if maybe I’m just making more work for myself and this is kind of unneeded.

Answer 1

There shouldn’t be any implications as long as you prevent users from being able to update the mechanism for privileges. If you have a boolean flag called is_admin for example, ensuring that you have attr_protected :is_admin is vital to protect against mass-updated from changing this privilege.