title: Form hidden fields and security
body: <p>I m using hidden field in my app to add user_id to my database "Camping". I have associations "User" has many campings and "Camping" belongs_to "user".</p>
  
  <p>When I run firebug or something like this, I can modify user_id value of this field. If any user puts his ID, I can modify object to other user... I want to avoid this !</p>
  
  <p>My code</p>
  
  <pre><code>&lt;%= f.hidden_field :user_id, :value =&gt; current_user.id %&gt;
  </code></pre>
  
  <p>This code, is necessary because I allow only user to edit / updated / create object if they have user_id == current_user.id. 
  How to fix this security problem ?</p>
  
  <p>By the way, I m using devise.</p>
  
  <h2>Edit with full code</h2>
  
  <p>My _form.html.erb</p>
  
  <pre><code>    &lt;%= form_for(camping) do |f| %&gt;
        &lt;% if camping.errors.any? %&gt;
          &lt;div id="error_explanation"&gt;
            &lt;h2&gt;&lt;%= pluralize(camping.errors.count, "error") %&gt; prohibited this camping from being saved:&lt;/h2&gt;
            &lt;ul&gt;
            &lt;% camping.errors.full_messages.each do |message| %&gt;
              &lt;li&gt;&lt;%= message %&gt;&lt;/li&gt;
            &lt;% end %&gt;
            &lt;/ul&gt;
          &lt;/div&gt;
        &lt;% end %&gt;
  
        &lt;%= f.hidden_field :user_id, :value =&gt; current_user.id %&gt;
  
      &lt;div class="form-group"&gt;
         &lt;label for="name"&gt;Nom du camping&lt;/label&gt;
            &lt;%= f.text_field :name, autofocus: true, class:"form-control", id:"name", :required =&gt; true%&gt;
        &lt;/div&gt;
  
    &lt;div class="actions"&gt;
      &lt;%= f.submit "Enregistrer", class:"btn btn-success" %&gt;
    &lt;/div&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>my controller</p>
  
  <pre><code>    def new
            @camping = Camping.new
            @campings = Camping.all
          end
  
  
          def edit
  
          end
  def create
        @camping = Camping.new(camping_params)
        respond_to do |format|
          if @camping.save
            format.html { redirect_to @camping, notice: 'Camping was successfully created.' }
            format.json { render :show, status: :created, location: @camping }
          else
            format.html { render :new }
            format.json { render json: @camping.errors, status: :unprocessable_entity }
          end
        end
      end
  
      def update
        @camping = Camping.find(params[:id])
        respond_to do |format|
          if @camping.update(camping_params)
            format.html { redirect_to @camping, notice: 'Camping was successfully updated.' }
            format.json { render :show, status: :ok, location: @camping }
          else
            format.html { render :edit }
            format.json { render json: @camping.errors, status: :unprocessable_entity }
          end
        end
      end
  </code></pre>
  
  <p>my edit.html.erb</p>
  
  <pre><code>&lt;div class="containershow"&gt;
  &lt;h1&gt;Editing Camping&lt;/h1&gt;
  
  &lt;%= render 'form', camping: @camping %&gt;
  
  &lt;%= link_to 'Show', @camping %&gt; |
  &lt;%= link_to 'Back', campings_path %&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>my new.html.erb</p>
  
  <pre><code>&lt;h1&gt;New Camping&lt;/h1&gt;
  
  &lt;%= render 'form', camping: @camping %&gt;
  
  &lt;%= link_to 'Back', campings_path %&gt;
  </code></pre>
  
  <h2>Edit solution ?</h2>
  
  <p>User can create and update his camping. I delete hidden_field</p>
  
  <pre><code> def create
       # @camping = Camping.new(camping_params)
  
          @camping = Camping.new((camping_params).merge(:user_id =&gt; current_user.id))
  
        respond_to do |format|
          if @camping.save
            format.html { redirect_to @camping, notice: 'Camping was successfully created.' }
            format.json { render :show, status: :created, location: @camping }
          else
            format.html { render :new }
            format.json { render json: @camping.errors, status: :unprocessable_entity }
          end
        end
      end
  </code></pre>