197

All the examples of strong parameters in Rails 4 docs use

params.require(:person).permit(:name, :age)

Could someone please deconstruct and explain what is occurring with require and permit here?

1
  • 4
    This example comes directly from the documentation, which explains permit but not require. Aug 26, 2013 at 2:17

3 Answers 3

267

The params in a controller looks like a Hash, but it's actually an instance of ActionController::Parameters, which provides several methods such as require and permit.

The require method ensures that a specific parameter is present, and if it's not provided, the require method throws an error. It returns an instance of ActionController::Parameters for the key passed into require.

The permit method returns a copy of the parameters object, returning only the permitted keys and values. When creating a new ActiveRecord model, only the permitted attributes are passed into the model.

It looks a lot like the whitelisting that was formerly included in ActiveRecord models, but it makes more sense for it to be in the controller.

3
  • 53
    The description of permit is a bit off: permit returns another hash that contains only the permitted key AND (this is critical) will respond with true to the permitted? method. By default, an instance of the ActionController::Parameters class will return false for permitted? Responding true to permitted? means the parameter object can be used in mass assignment; else the app will throw a ForbiddenAttributes error.
    – sameers
    Nov 13, 2013 at 18:05
  • 5
    Does chaining permit on require also permit and include the required parameters in the returned object?
    – Dennis
    Apr 6, 2016 at 14:49
  • 2
    I find the naming unfortunate, as require does a lot more than making a permitted parameter required. Using params.permit(:person, :name, :age) does not work, and generates errors like "Unpermitted parameters: :utf8" for a typical form.
    – Damien
    Aug 30, 2018 at 13:03
23

Think of require as validation and permit as filtering.

  • require will return the params under the given key if present, or raise
  • permit will return the params filtered on the given keys*

Examples based on https://apidock.com/rails/ActionController/Parameters/permit

>> params = ActionController::Parameters.new(user: { name: "Francesco", age: 22, role: "admin" })
{
    "user" => {
        "name" => "Francesco",
         "age" => 22,
        "role" => "admin"
    }
}

>> params.require(:user).permit(:name, :age)
Unpermitted parameter: role
{
    "name" => "Francesco",
     "age" => 22
}

>> params.require(:user)
{
    "name" => "Francesco",
     "age" => 22,
    "role" => "admin"
}

>> params.require(:user).permit(:foo)
Unpermitted parameters: name, age, role
{}

>> params.require(:person)
ActionController::ParameterMissing: param is missing or the value is empty: person

>> params.permit(:user)
Unpermitted parameter: user
{}

* Note that permit only allows certain scalars to pass the filter, as seen in the last example. The associated data must be of type String, Symbol, NilClass, Numeric, TrueClass, FalseClass, Date, Time, DateTime, StringIO, IO, ActionDispatch::Http::UploadedFile or Rack::Test::UploadedFile. Everything else, including containers like Array and Hash, are filtered out.

11

To be more precise, when you create for eg. doing .new(...), there must be :person hash indicated by require and the person hash will only accept :name and :age indicated by permit.

Example:

.new(person: { name: "Bhojendra", age: 32 }) // okay
.new(person: { name: "Rauniyar" }) // okay
.new(person: { name: "Bhojendra", other: 'asdf' }) // not okay, other not permitted
.new(person: { full_name: "Bhojendra Rauniyar" }) // not okay, full_name not permitted
.new(detail: { name: "Bhojendra", age: 32 }) // not okay, must be person
2
  • What do 3rd and 4th not okay example visualize? May 17, 2019 at 5:47
  • @p0k8_ I edited the answer to clarify that. Those examples show some different field names which were not "permitted".
    – Harry Wood
    Sep 20, 2019 at 9:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.