Take the 2-minute tour ×

Is it possible to hide/mask the urls in the java play framework. The problem I have come across is I want a user to be able to log in and view messages belonging to them but I do not want any old user to find theses messages by simply hacking the url.

What I have got is a Notifications controller which has a method called show(long id).

my route for this method is:

GET     /Message/Show               Notifications.show

i call the function using


the url for this function is:


Is it possible to remove the parameter off the end of the url so people can not hack into certain urls by guessing parameters.

share|improve this question
add comment

4 Answers

This is something that can be achieved with Interceptions.


Inside these classes you can check if the current user is logged in (store in session)

share|improve this answer
I agree - you should just throw an exception if someone requests a message that they are not authorized to see. As opposed to trying to hide the fact that you're including the id in the url. While you could obfuscate things with javascript, it could never completely prevent guessing without requiring an additional secret. –  Scott A Miller Sep 27 '11 at 14:27
Yes this would be a better solution but how do you throw that exception, I understand how you check to see if a user is authorized i.e logged on, but I do not know how you would authorize a specific url to a user. e.g. Show?id=8 can only be read by "User B". –  Jon R Sep 27 '11 at 14:48
That would need to be part of your data model. How do you currently decide which messages appear as urls for a given user? –  Scott A Miller Sep 27 '11 at 15:12
I have posted a answer to my problem scott, is this that what you meant? –  Jon R Sep 28 '11 at 9:01
Yep. That's essentially the same approach that I would take. Since this check is specific to the show action, an interception would probably have more overhead than benefit. –  Scott A Miller Sep 28 '11 at 13:10
add comment

If I got this right, you want to hide URLs so users don't know them and do not enter them. If they do, they would see content they shouldn't see. This is bad and should not be done this way, take a look at Security through obscurity (Wikipedia), use readable/bookmarkable URLs and build proper login and security mechanisms like leifg suggested.

share|improve this answer
add comment
up vote 2 down vote accepted

This is the approach I used, I do not know if this is the best way around this but it does work how I want it to.

Thanks for all the help and ideas.

public static void show(long id)
        Notification notification = Notification.findById(id);
        User connectedUser = User.find("byEmail", Security.connected()).first();

            forbidden("This isnt your message stop hacking the urls!");     
share|improve this answer
add comment

Or you could log in the user and fetch only the users message.

Why search a complicate solution such as obfuscation/interceptions and whatever when a very simple solution exists. Use the session of the connected user, fetch only his messages and done.

share|improve this answer
This works well if the only viewable page shows all of the user's messages. You need the identifier if there is a separate page for viewing a specific message. But I agree, this is a good approach if applicable. –  Scott A Miller Sep 29 '11 at 20:53
Then check if the message is owned by user. If not reject by 403 header. –  i.am.michiel Sep 29 '11 at 22:39
add comment

Your Answer


