ruby on rails - how can I hide params I transmit to a method (like form_for seems to do)?

Question

I've been searching for hours now and haven't found anything that helps.

What I want to do:

I need to call the check_login-Method (as below), which needs parameters.

redirect_to check_login_users_url(
  :user => {:name => input[1], :password => input [2] },
  :stylesheet => 'scaffold',
  :method => :get)

The point is that these params are sent in the method-call as in the "Redirected to"-line below.

Processing ApplicationController#execute(for 127.0.0.1 at 2009-12-19 00:28:40) [POST]
Parameters: {"command"=>{"line"=>"log dodo wg"}, "authenticity_token"=> <...token>}
Redirected to http://localhost:3000/benutzer/check_login?method=get&stylesheet=scaffold&user%5Bname%5D=dodo&user%5Bpassword%5D=wg
Completed in 9ms (DB: 0) | 302 Found [http://localhost/execute]

---

I want to prevent rails from putting the params into the url and pass them hidden instead.

When I send a form created with form_for, there's nothing in the url, so I assume it must be possible.

Please tell me how to do that.

---

Steps tried

• I have tried different "html-verbs": get, put, post - no difference. Though the call of check_login is really short the url-with-params shows up in my Console
• create an instance variable and pass it as param (strange, didn't work either)
• watch form_for working –?without results, got no clue

---

---

//edith:
Thanks for all your help so far. Perhaps I didn't specify my problem in enough detail. I've got a text_field in which I enter short commands (experimentally). Its form calls execute in AppController, which in case of login-data performs redirect_to check_login. I don't need to access a webpage, I simply want to run the method. I liked the idea of putting it into :flash, but I'm wondering if there's a "neater" way to do pass the data hidden.

Answer 1

TL; DR Version: Use a form.

You're never going to be able to fully hide parameters, tools can be used to monitor requests and view the post data/parameters. You could however obfuscate it with an encrypted session. Also it appears that you're sending login info via a GET request, this is generally a bad practice.

That said...

What is going wrong for you is that you're not generating any post data with link_to :method => :post. link_to will use what ever parmas you give it to generate the url. Wheres forms will send all the params generated by the form as POST data to the url generated in the form_for call.

Upon receiving a POST request, Rails will merge parameters routing picks up from from the URL with the post data it receives into one params hash.

As in POST to

http://localhost:3000/benutzer/check_login?stylesheet=scaffold&user%5Bname%5D=dodo&user%5Bpassword%5D=wg

produces the same params hash in the receiving controller action as a POST to http://localhost:3000/benutzer/check_login with the following data:

 stylesheet=scaffold&user[name]=dodo&user[pasword]=wg

There will be no distinction in the server log between the two requests.

If you look at what form_for is doing, it submits POST data built from the form inputs to the url generated by the arguments.

form_for @user, create_user_url(:stylesheet => "scaffold") do |f|
  f.text_field :name
  f.password_field, :password
end

This form will submit the form data to the url generated from the options. In this example the url is: http://localhost:3000/users/create?stylesheet=scaffold and the form data is:

user[name]=name_field_value_at_submit&user[password]=password_field_value_at_submit

link_to will not populate post data for you. You must either do it through a form or with javascript. The link_to documentation contains an example of doing this with javascript. Look for how the destroy with :onclick is handled.

If you really don't like buttons, you could use link_to_function to submit a form.