3 ms·
If you've recently started a new Rails project (or are thinking about it), you should use strong_parameters right off the bat!
by mikeycgto 14y ago
If you've recently started a new Rails project (or are thinking about it), you should use strong_parameters right off the bat!
- steveklabnik 14y agoAgreed! That is what I teach when I do training.
- pekk 14y agoWhy is strong_parameters not the only way? Rails is pretty opinionated in many other respects...
- jenius 14y agoIt will be the default in rails 4... so soon : )
- bratsche 14y agoIt was opinionated to use attr_accessible until a better approach came along. Beginning in 4.0 it will be opinionated to use strong_parameters, but they can't just take attr_accessible away because a lot of people are upgrading apps.
- steveklabnik 14y agoThe downside of 'don't break APIs for minor version changes' means that you can't break APIs until the major version changes. ;)
- joevandyk 14y agoI'm not 100% positive, but I don't think strong_parameters would do anything to protect you here.
- steveklabnik 14y agoIt would not have helped with this vulnerability, no. But it is a better way of handling filtering appropriate parameters.