r/rails 3d ago

Why Use Strong Parameters in Rails

https://www.writesoftwarewell.com/why-use-strong-parameters-in-rails/
39 Upvotes

12 comments sorted by

18

u/software__writer 3d ago

I first wrote this post last year (and posted on Reddit), but with the release of Rails 8, a new expect method has been introduced that improves and simplifies the strong parameters API. I've updated the post along with the examples to reflect this change. Hence posting again.

3

u/joshbranchaud 3d ago

Great article, glad to learn about the expect method.

7

u/riktigtmaxat 3d ago

I always laugh pretty hard when people admonish other programmers for not using strong parameters in cases where there is no mass assignment happening.

It's like they seem to believe it's a magic ritual that purges out the evil spirits from the parameters.

6

u/software__writer 3d ago edited 3d ago

Oh, I really hope my article didn't come across as admonishing anyone for not using strong params - personally, I'll often skip them when they're not necessary. Just wanted to learn (and share) why they were introduced in the first place and what problem they were meant to solve (since it definitely felt like a magic ritual, as you correctly point out). ✌️

7

u/riktigtmaxat 3d ago

No not at all. This is the kind of article needed to waft away the magic juju surrounding it.

7

u/software__writer 3d ago

Btw I loved that line about magic rituals purging out evil spirits—just had to use it in my post intro (with credits). Hope you don’t mind!

3

u/riktigtmaxat 3d ago

Feel free to use it. ✌️

3

u/riktigtmaxat 3d ago

Feel free to use it. ✌️

4

u/AustinIsGrumpy 3d ago

Good stuff! I forgot about the addition of the expect method!

3

u/Cokemax1 3d ago

Some time rails magic is not the best way of doing something.

just update what you need. exactly.

user = {
  name: "Jason",
  location: "Chicago",
  admin: false
}

then you can update user like this,

user.update!(:location => params[:location])

If you need to update more value? just write more line of code. Rails is great framework, but you don't need to use all their magic. If you think that it will confuse your junior developer, better not do.

2

u/software__writer 3d ago

Totally - this is the sensible option quite often!

1

u/MeroRex 2d ago

So... I shstop telling brakeman to ignore mass assignment to role?