I'm pretty sure Rails has a secure default behavior. They use an [Initialization vector](http://en.wikipedia.org/wiki/Initialization_vector) when encrypting data, which should address your concern.

In doing my research, it also seems like standard practice to include the current timestamp to prevent replayability (so, we might allow the link to work for an hour, but after that, it's just garbage).

There's some other best-practices I'm seeing, but they might be Rails 4+ only, I'm still checking up on them, and will add them to this comment later.