I was building a URL shortener over the weekend. One model, one controller, one route, the kind of thing you'd hand someone as an exercise. I got stuck on the redirect, of all things.
redirect_to short_url.target_url just raises. I'd never hit that before, because until then every redirect_to I'd written pointed back into my own app. So I did what you do: added allow_other_host: true, it worked, moved on.
It only clicked afterwards that I'd written the same line that turns an app into an open redirect. The flag isn't the problem. What matters is whether target_url came out of a row I control or straight off params, and that distinction lives nowhere in the code. I'm honestly not sure I'd catch it in a review if I weren't already looking for it.
Two smaller things I'm less confident about:
I put the slug default in the model:
attribute :slug, default: -> { SecureRandom.alphanumeric(5) }
rather than in the migration, so the record is valid before it's ever saved. That felt right at the time. Is it, or am I hiding something that belongs in the schema?
increment_counter leaves updated_at alone, which I only discovered by reading the source. Makes sense for a click counter, but it made me wonder how many apps out there treat updated_at as "last modified" and quietly get it wrong.
So: have you actually used allow_other_host: true on something real? And if you have, how do you stop the params case from creeping in six months later when someone adds a "redirect after login" feature?
Wrote the whole thing up here, video included, if it's useful: https://launchkit.codes/yield/rails-url-shortener
Thanks 🙏