Ruby on Rails latest stable (v5.2.3) - 0 notes - Superclass: ActiveSupport::HashWithIndifferentAccess

Action Controller Parameters

Allows you to choose which attributes should be whitelisted for mass updating and thus prevent accidentally exposing that which shouldn’t be exposed. Provides two methods for this purpose: #require and #permit. The former is used to mark parameters as required. The latter is used to set the parameter as permitted and limit which attributes should be allowed for mass updating.

params = ActionController::Parameters.new({
  person: {
    name: "Francesco",
    age:  22,
    role: "admin"

permitted = params.require(:person).permit(:name, :age)
permitted            # => <ActionController::Parameters {"name"=>"Francesco", "age"=>22} permitted: true>
permitted.permitted? # => true

# => #<Person id: 1, name: "Francesco", age: 22, role: "user">

It provides two options that controls the top-level behavior of new instances:

  • permit_all_parameters - If it’s true, all the parameters will be permitted by default. The default is false.

  • action_on_unpermitted_parameters - Allow to control the behavior when parameters that are not explicitly permitted are found. The values can be false to just filter them out, :log to additionally write a message on the logger, or :raise to raise ActionController::UnpermittedParameters exception. The default value is :log in test and development environments, false otherwise.


params = ActionController::Parameters.new
params.permitted? # => false

ActionController::Parameters.permit_all_parameters = true

params = ActionController::Parameters.new
params.permitted? # => true

params = ActionController::Parameters.new(a: "123", b: "456")
# => <ActionController::Parameters {} permitted: true>

ActionController::Parameters.action_on_unpermitted_parameters = :raise

params = ActionController::Parameters.new(a: "123", b: "456")
# => ActionController::UnpermittedParameters: found unpermitted keys: a, b

Please note that these options *are not thread-safe*. In a multi-threaded environment they should only be set once at boot-time and never mutated at runtime.

You can fetch values of ActionController::Parameters using either :key or "key".

params = ActionController::Parameters.new(key: "value")
params[:key]  # => "value"
params["key"] # => "value"




PERMITTED_SCALAR_TYPES = [ String, Symbol, NilClass, Numeric, TrueClass, FalseClass, Date, Time, # DateTimes are Dates, we document the type but avoid the redundant check. StringIO, IO, ActionDispatch::Http::UploadedFile, Rack::Test::UploadedFile, ]


[R] parameters
Show files where this class is defined (1 file)
Register or log in to add new notes.