Ufdjrw

Why doesn't a table tennis ball float on the surface? How do we calculate buoyancy here?

Inappropriate reference requests from Journal reviewers

Grabbing quick drinks

How to be diplomatic in refusing to write code that breaches the privacy of our users

Increase performance creating Mandelbrot set in python

Should I tutor a student who I know has cheated on their homework?

Only print output after finding pattern

How do spells that require an ability check vs. the caster's spell save DC work?

If the heap is initialized for security, then why is the stack uninitialized?

Term for the "extreme-extension" version of a straw man fallacy?

Which organization defines CJK Unified Ideographs?

% symbol leads to superlong (forever?) compilations

Implement the Thanos sorting algorithm

How to safely derail a train during transit?

Why did we only see the N-1 starfighters in one film?

Was a professor correct to chastise me for writing "Prof. X" rather than "Professor X"?

Too much space between section and text in a twocolumn document

Natural language into sentence logic

What's the point of interval inversion?

How do I solve this limit?

Why do remote companies require working in the US?

Is HostGator storing my password in plaintext?

Where to find order of arguments for default functions

Unreliable Magic - Is it worth it?

Do I need to use strong params if action doesn't affect models?

0

I'm 80% sure the answer is "no", but I need affirmation.

Case scenario

For controller looking like this:

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', search_cats_params)
 end

 private

 def search_cats_params
 params.permit(:breed, :ownership, :vaccination, foo: [ :bar, :baz ])
 end
end

Would it be safe to just pass the params forward like this?

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', params.to_h)
 end
end

Wouldn't user be able to flood server with enormous query, for example?

Documentation only says strong params exist to protect models from malicious mass assignment.

https://edgeapi.rubyonrails.org/classes/ActionController/StrongParameters.html

ruby-on-rails

share|improve this question

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  IMO it would still be best to limit what is sent to a third party API, especially if you pay to use the API or the API has any kind of acceptable use policy. Passing params straight through could result in you being banned from the API because you have 1 malicious user that ruins it for you and everyone else.
  
  – engineersmnky
  Mar 7 at 14:34
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  internet is scary place i always prefer to use strong params in my controllers.
  
  – user3775217
  Mar 8 at 10:16
  

  
  
  
  

add a comment | 

0

I'm 80% sure the answer is "no", but I need affirmation.

Case scenario

For controller looking like this:

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', search_cats_params)
 end

 private

 def search_cats_params
 params.permit(:breed, :ownership, :vaccination, foo: [ :bar, :baz ])
 end
end

Would it be safe to just pass the params forward like this?

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', params.to_h)
 end
end

Wouldn't user be able to flood server with enormous query, for example?

Documentation only says strong params exist to protect models from malicious mass assignment.

https://edgeapi.rubyonrails.org/classes/ActionController/StrongParameters.html

ruby-on-rails

share|improve this question

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  IMO it would still be best to limit what is sent to a third party API, especially if you pay to use the API or the API has any kind of acceptable use policy. Passing params straight through could result in you being banned from the API because you have 1 malicious user that ruins it for you and everyone else.
  
  – engineersmnky
  Mar 7 at 14:34
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  internet is scary place i always prefer to use strong params in my controllers.
  
  – user3775217
  Mar 8 at 10:16
  

  
  
  
  

add a comment | 

I'm 80% sure the answer is "no", but I need affirmation.

Case scenario

For controller looking like this:

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', search_cats_params)
 end

 private

 def search_cats_params
 params.permit(:breed, :ownership, :vaccination, foo: [ :bar, :baz ])
 end
end

Would it be safe to just pass the params forward like this?

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', params.to_h)
 end
end

Wouldn't user be able to flood server with enormous query, for example?

Documentation only says strong params exist to protect models from malicious mass assignment.

https://edgeapi.rubyonrails.org/classes/ActionController/StrongParameters.html

ruby-on-rails

share|improve this question

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', search_cats_params)
 end

 private

 def search_cats_params
 params.permit(:breed, :ownership, :vaccination, foo: [ :bar, :baz ])
 end
end

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', params.to_h)
 end
end

share|improve this question

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

share|improve this question

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34