Be Careful with GIDs in Rails
blog.julik.nl
Be Careful with GIDs in Rails
1–10 of 22 posts
Re: Be Careful with GIDs in Rails
#2Any popular Rails apps that use to_global_id?
Re: Be Careful with GIDs in Rails
#3This title is odd, given the actual identified problem seems to be LLMs writing code.
Re: Be Careful with GIDs in Rails
#4A bit of a bizarre post since to_sgid has existed forever to generate signed global ids. Global IDs are probably one the most powerful and underrated features of Rails but regular global ids are only supposed to be used internally (e.g. job params) and never sent to the client.
If there’s a gotcha it’s that _signed_ global ids are only signed, not encrypted, and very few people seem to know about the optimised method (globalid::Locator.locate_many) for loading a batch of global ids
Re: Be Careful with GIDs in Rails
#5Any popular Rails apps that use to_global_id?
The built-in ActiveJob api uses them.
Re: Be Careful with GIDs in Rails
#6Rails is a dangerous place to be throwing random data into APIs.
Re: Be Careful with GIDs in Rails
#7the AI hallucinated and somehow it's rails fault?
GID's are great - i think the issue is with how they leveraged rubyLLM for something they should inherently not be using LLMs for.
> Remember that GIDs were made for facilitating ActiveJob serialization - they are a system-level facility, not a product-level facility.
I think this is somewhat obvious given the signature like gid://awesome-app/Post/32; there is no scoping to the user or account so it should be treated like a global lookup. If you need scoping to a user/account you can build that.
Honestly I think this is a matter of the author using poor design decisions and over leveraging LLMs. But this is not the fault of Rails, it is working as expected.
Be careful with LLMs!
Re: Be Careful with GIDs in Rails
#8> GIDs are not checked for authorization when doing the lookup - they are meant to be generated above the authorization layer, and to be consumed above the authorization layer
Then the problem with this post boils down to applying the authorization layer in any tool call, just like you do in controllers. Seems obvious?
Re: Be Careful with GIDs in Rails
#9This title is odd, given the actual identified problem seems to be LLMs writing code.
yeah, but if you say LLM is shit, and not rails... goodbye views :)
Re: Be Careful with GIDs in Rails
#10Any popular Rails apps that use to_global_id?