Iconoclast Labs

Upgrading to Rails 4 - Parameters Security Tour

Until now, we were relying too much on the Model being smart. Writing code is often a balancing act and it's felt like the "fat model" trend has been pushing everything it can to that side of the application, this change allows the app to be more evenly delineated again. Models don't have to worry as much about varied access rights to data which is something that usually sounds like the controller's job. They can return to simply making the sure data operations are valid. Scaffolds and Generators are safer. You've got a centralized spot to worry about what should and should not be exposed to a controller or action, and your code is less likely to have mass assignment slip through the cracks. It's been a common pattern to have parameter access delegated through a private method but now that good idea is enforced. Mass assignment is still there if you need it . Some scenario...

Full article: http://iconoclastlabs.com/cms/blog/posts/upgrading-to-rai...