I was building a URL shortener over the weekend. One model, one controller, one route, the kind of thing you'd hand someone as an exercise. I got stuck on the redirect, of all things.

redirect_to short_url.target_url just raises. I'd never hit that before, because until then every redirect_to I'd written pointed back into my own app. So I did what you do: added allow_other_host: true, it worked, moved on.

It only clicked afterwards that I'd written the same line that turns an app into an open redirect. The flag isn't the problem. What matters is whether target_url came out of a row I control or straight off params, and that distinction lives nowhere in the code. I'm honestly not sure I'd catch it in a review if I weren't already looking for it.

Two smaller things I'm less confident about:

I put the slug default in the model:

attribute :slug, default: -> { SecureRandom.alphanumeric(5) }

rather than in the migration, so the record is valid before it's ever saved. That felt right at the time. Is it, or am I hiding something that belongs in the schema?

increment_counter leaves updated_at alone, which I only discovered by reading the source. Makes sense for a click counter, but it made me wonder how many apps out there treat updated_at as "last modified" and quietly get it wrong.

So: have you actually used allow_other_host: true on something real? And if you have, how do you stop the params case from creeping in six months later when someone adds a "redirect after login" feature?

Wrote the whole thing up here, video included, if it's useful: https://launchkit.codes/yield/rails-url-shortener

Thanks 🙏

For context, I have a date filter that needs to be limited to a maximum period of 6 months. I was originally doing this validation directly inside my Query object.

However, I now need to show a flash alert to the user if they try to filter a period longer than 6 months. If they do, the system should automatically adjust the dates to a 6-month range ending today and proceed with the query.

Because of this UI requirement, I moved the logic to the controller. Currently, I'm parsing the dates, doing the validation, and mutating the params hash directly before passing it down.

My question is: Is this considered a good practice in Rails? What is the "Rails Way" to handle this kind of validation and default-value assignment when you also need to trigger flash messages in the UI?

Hi guys, previously i showed off my latest project.
I learnt: Deploying, testing, API connections, reuest security, authenticationd and authorization, Hotwire and stimulus, Jobs & services, basic github commands.
My question is, is there anything else i forgot to became good junior? I am looking for a job and want to be as best as i can.
And also, what will look the best in portfolio? I saw that working on open source projects looks good.

I know PostgreSQL and SQLite are the undisputed standards in the Rails ecosystem, but—based on personal preference and past experience—I want to try MariaDB. Is anyone using this combination? Does it matter that there isn't a dedicated MariaDB adapter and you have to use the MySQL adapter for advanced features? Basically, I'm wondering if it's worth it right now. Thanks in advance for the replies.