title: Looking for suggestions for building a secure REST API within Ruby on Rails
body: <p>I'm getting started on building a REST API for a project I'm working on, and it led me to do a little research as to the best way to build an API using RoR. I find out pretty quickly that by default, models are open to the world and can be called via URL by simply putting a ".xml" at the end of the URL and passing appropriate parameters.</p>
  
  <p>So then the next question came. How do I secure my app to prevent unauthorized changes? In doing some research I found a couple articles talking about <code>attr_accessible</code> and <code>attr_protected</code> and how they can be used. The particular URL I found talking about these was posted back in May of '07 (<a href="http://railscasts.com/episodes/26-hackers-love-mass-assignment" rel="noreferrer">here</a>). </p>
  
  <p>As with all things ruby, I'm sure that things have evolved since then. So my question is, is this still the best way to secure a REST API within RoR?</p>
  
  <p>If not what do you suggest in either a "new project" or an "existing project"scenario?</p>