3 ms·
This kind of sums up the point of contention. Rails, by default, does things like escaping input and output strings, CSRF protection, masking password fields i
by jarin 15y ago
This kind of sums up the point of contention.
Rails, by default, does things like escaping input and output strings, CSRF protection, masking password fields in the logs, etc. So why doesn't it do the same with attribute assignment?
- capsule_toy 15y agoI'll take a guess and say it's because it's not possible to magically generate that code. If I wrote a code generator, there's no way that program could know which attributes should be accessible. The only way to get a scaffold to work out of the box is to require some user configuration or allow all attributes to be modifiable. It's a case of ease-of-use trumping security.
- speleding 15y agoAs homakov suggested, you could at least define *_id attributes as "protected" by default. Only being able to change attributes on your own records probably causes a lot less grieve.