articles Different strong parameters on create and update

20 Jul 2020
#ruby #rails #strong parameter
Do you want to learn about about the security considerations of LLMs in a development workflow? How about securing LLM driven functionality? If you want to learn about these, I run an online workshop on this topic:
Security in the age of AI.
When using strong-parameters, sometimes you only want to enable a subset of the same parameters on create or edit. To achieve this, you can define 2 separate sets like this: 
...
def post_create_params
	params[:posts].permit(:category_id, :title, :body)
end

def post_update_params
	params[:posts].permit(:title, :body)
end
...
But there is a neater way to achieve the same by utilising ActionController::Parameters#except: 
...
def update
	@post.update(post_params.except(:category_id))
end

private
  def post_params
	params[:posts].permit(:category_id, :title, :body)
  end
...

Or follow me on Twitter

Related posts