API Guides

class Parameters

Ruby on Rails 7.0.10

Since v4.0.13

Available in: v4.0.13 v4.1.16 v4.2.9 v5.2.8.1 v6.0.6 v6.1.7.10 v7.0.10 v7.1.6 v7.2.3 v8.0.4 v8.1.2

Action Controller Parameters

Allows you to choose which attributes should be permitted for mass updating and thus prevent accidentally exposing that which shouldn’t be exposed. Provides two methods for this purpose: #require and #permit. The former is used to mark parameters as required. The latter is used to set the parameter as permitted and limit which attributes should be allowed for mass updating.

params = ActionController::Parameters.new({
  person: {
    name: "Francesco",
    age:  22,
    role: "admin"
  }
})

permitted = params.require(:person).permit(:name, :age)
permitted            # => #<ActionController::Parameters {"name"=>"Francesco", "age"=>22} permitted: true>
permitted.permitted? # => true

Person.first.update!(permitted)
# => #<Person id: 1, name: "Francesco", age: 22, role: "user">

It provides two options that controls the top-level behavior of new instances:

  • permit_all_parameters - If it’s true, all the parameters will be permitted by default. The default is false.

  • action_on_unpermitted_parameters - Controls behavior when parameters that are not explicitly

    permitted are found. The default value is <tt>:log</tt> in test and development environments,
+false+ otherwise. The values can be:

    • false to take no action.

    • :log to emit an ActiveSupport::Notifications.instrument event on the unpermitted_parameters.action_controller topic and log at the DEBUG level.

    • :raise to raise an ActionController::UnpermittedParameters exception.

Examples:

params = ActionController::Parameters.new
params.permitted? # => false

ActionController::Parameters.permit_all_parameters = true

params = ActionController::Parameters.new
params.permitted? # => true

params = ActionController::Parameters.new(a: "123", b: "456")
params.permit(:c)
# => #<ActionController::Parameters {} permitted: true>

ActionController::Parameters.action_on_unpermitted_parameters = :raise

params = ActionController::Parameters.new(a: "123", b: "456")
params.permit(:c)
# => ActionController::UnpermittedParameters: found unpermitted keys: a, b

Please note that these options *are not thread-safe*. In a multi-threaded environment they should only be set once at boot-time and never mutated at runtime.

You can fetch values of ActionController::Parameters using either :key or "key".

params = ActionController::Parameters.new(key: "value")
params[:key]  # => "value"
params["key"] # => "value"

Inherits from

Object

Constants

Attributes

Methods (defined here)

Private methods

(16) Implementation detail — not part of the public API.

Methods (inherited)

From Object (16)
From ActiveRecord::TestFixtures (4)
From ActiveSupport::Concern (3)

Type at least 2 characters to search.

↑↓ navigate · ↵ open · esc close