Ruby on Rails - Strong Parameters

Introduction

Strong parameters in Rails help prevent mass assignment vulnerabilities by specifying which parameters are allowed to be used in your controllers. This feature is crucial for maintaining the security of your Rails application. This guide will cover how to use strong parameters in Rails controllers.

Basic Usage

To use strong parameters, you define a private method in your controller that specifies the permitted parameters. Here is an example:

# app/controllers/articles_controller.rb
class ArticlesController < ApplicationController
  def create
    @article = Article.new(article_params)
    if @article.save
      redirect_to @article
    else
      render :new
    end
  end

  def update
    @article = Article.find(params[:id])
    if @article.update(article_params)
      redirect_to @article
    else
      render :edit
    end
  end

  private

  def article_params
    params.require(:article).permit(:title, :body)
  end
end
                

In this example, the article_params method specifies that only the title and body parameters are permitted.

Permitting Nested Parameters

Strong parameters also support nested parameters. Here is an example of how to permit nested parameters:

# app/controllers/articles_controller.rb
class ArticlesController < ApplicationController
  # Other actions...

  private

  def article_params
    params.require(:article).permit(:title, :body, comments_attributes: [:id, :content, :_destroy])
  end
end
                

In this example, the comments_attributes nested parameters are also permitted, allowing for the creation and modification of associated comments.

Using Conditional Parameters

Sometimes you may need to permit different parameters based on certain conditions. Here is an example:

# app/controllers/articles_controller.rb
class ArticlesController < ApplicationController
  # Other actions...

  private

  def article_params
    if current_user.admin?
      params.require(:article).permit(:title, :body, :admin_notes)
    else
      params.require(:article).permit(:title, :body)
    end
  end
end
                

In this example, the admin_notes parameter is permitted only if the current user is an admin.

Permitting Arrays

You can also permit arrays of scalar values. Here is an example:

# app/controllers/articles_controller.rb
class ArticlesController < ApplicationController
  # Other actions...

  private

  def article_params
    params.require(:article).permit(:title, :body, tag_ids: [])
  end
end
                

In this example, the tag_ids parameter is permitted as an array, allowing for multiple tags to be assigned to an article.

Custom Sanitization

In some cases, you may need to perform custom sanitization on the parameters. Here is an example:

# app/controllers/articles_controller.rb
class ArticlesController < ApplicationController
  # Other actions...

  private

  def article_params
    params.require(:article).permit(:title, :body).tap do |whitelisted|
      whitelisted[:metadata] = params[:article][:metadata]
    end
  end
end
                

In this example, the metadata parameter is added to the permitted parameters through custom sanitization.

Handling Unpermitted Parameters

By default, Rails will raise an error if unpermitted parameters are submitted. You can customize this behavior. Here is an example:

# config/application.rb
module MyApp
  class Application < Rails::Application
    config.action_controller.action_on_unpermitted_parameters = :log
  end
end
                

In this example, unpermitted parameters will be logged instead of raising an error.

Conclusion

Strong parameters are a critical feature in Rails for ensuring the security of your application by preventing mass assignment vulnerabilities. By understanding how to use strong parameters, you can control which parameters are allowed in your controllers and maintain the integrity of your data.