Rails: Using require and permit for attributes

Raising errors for required and permitted attributes makes it easier to find errors in your application during development and in tests. Consider this approach if you want to strengthen the params handling in your application.

Example

Copyconfig.action_controller.action_on_unpermitted_parameters = :raise

Copydef user_params
  params.require(:user).permit(:full_name)
end

Effects

• This raises an error ActionController::ParameterMissing if there is no required parameter:

  • In production users see a bad request error page.
  • In production the error is ignored in Sentry Show archive.org snapshot by default.

• This raises an error ActionController::UnpermittedParameters if there is an unpermitted parameter:

  • You need to manually merge it to the rescue_responses in case users should see a bad request error page.
  • You need to add it manually to sentry on the ignore list in case it should not be reported as exception.