Security in RailsEdit

Created 5/24/2007, updated 3/12/2020

Always use attr_accessible

See:

Protecting controller actions

Any public method in a controller class can be called from a web browser. For example, consider the following method:

class UsersController < ApplicationController
  def nuke_database
    User.destroy_all
  end
end

This method can be called from a browser using a URL like: http://example.com/users/nuke_database/

This is because the default routing in config/routes.rb allows it:

map.connect ':controller/:action/:id'

When you try to access such a URL Rails will look for a view template at app/views/users/nuke_database.rhtml and most likely not find it. Nevertheless, by the time the view-related error occurs the body of the method will already have been executed. It is therefore absolutely essential that you declare all methods that aren't public actions as protected:

class UsersController < ApplicationController
  def index
    # public method
  end

protected

  def nuke_database
    User.destroy_all
  end
end

Sessions

Articles on session security:

See also