RailsCasts Pro episodes are now free!

Learn more or hide this

Hackers Love Mass Assignment (revised)

#26 Hackers Love Mass Assignment (revised)

Mar 08, 2012 | 6 minutes | Active Record, Security, Models
One of the most common security issues in a Rails application is the mass-assignment vulnerability which allows a user to set any attribute on the model. Learn how to prevent it in this episode.
Click to Play Video ▶
  • Download:
  • source codeProject Files in Zip (102 KB)
  • mp4Full Size H.264 Video (14.3 MB)
  • m4vSmaller H.264 Video (7.39 MB)
  • webmFull Size VP8 Video (8.49 MB)
  • ogvFull Size Theora Video (16.3 MB)
Browse_code Browse Source Code

Resources

Note: I accidentally mentioned the wrong episode at the end. Instead the episode on dynamic attr_accessible is 237.

models/user.rb 
attr_accessible :name
config/application.rb 
config.active_record.whitelist_attributes = true