Turbo Streams: security
Turbo Streams: security examines what a signed stream name protects and what it leaves open. The lessons read the installed turbo-rails source. They show that one application-wide key signs every name, that the payload decodes with plain Base64, and that signed names never expire. Access control comes from the page guard that renders the turbo_stream_from tag. The course also covers scoping a stream to a record through GlobalID, custom channels with subscription_allowed?, and a four-question checklist for deciding what goes into a streamable.
What you'll learn
- ✓Why a signed stream name is authentic without being authorized
- ✓How Base64 decoding shows that signing does not hide a payload
- ✓Using page guards such as require_login as the access boundary for a stream
- ✓Scoping streams to records through GlobalID and to_gid_param
- ✓Why signed names never expire and when a custom channel with subscription_allowed? is needed
- ✓A checklist for choosing what goes into a streamable
Signed does not mean authorized
A signed stream name (two courses ago) can't be tampered with. A client can't invent a new one; it can only present one the server generated. That fact answers one question and leaves another open. Proving a name is genuine says nothing about whether this visitor, right now, should be allowed to…
Read the full lesson free →Curriculum
7 lessonsSigned does not mean authorized
A signed stream name proves the server generated it, but Turbo's channel never checks who is subscribing.
Signed does not mean secret
Signing gives integrity without confidentiality: plain Base64.decode64 recovers a stream name's payload without any key.
The real boundary is the page
Request guards like require_login decide who loads the page, and so who receives the turbo_stream_from tag.
Scoping a stream to one record
Passing a record to turbo_stream_from builds the name from its GlobalID, so different models never collide.
Signed names do not expire
Turbo never passes an expiration option, so a leaked signed name works until the signing key changes.
Choosing what goes into a streamable
Four questions drawn from the earlier lessons decide what is safe to hand to turbo_stream_from.
Putting it together: from public to private
A recap of the findings, from the public roadmap stream to the two layers a private stream needs.