# Field security best practice

**URL:** <https://www.ruby-forum.com/t/field-security-best-practice/144505>\
**Category:** Rails\
**Created:** [July 30, 2008, 1:20pm UTC](https://www.ruby-forum.com/t/field-security-best-practice/144505 "2008-07-30T13:20:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![remcoh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/c37758/32.png) [@remcoh](https://www.ruby-forum.com/u/remcoh)\
**Post date:** [July 30, 2008, 1:20pm UTC](https://www.ruby-forum.com/t/field-security-best-practice/144505/1 "2008-07-30T13:20:03Z")

</div>

Suppose i have a model (userprofile) which may be altered by users and  
admins, only 1 field (roll) may only be altered by admins.

of course i can exclude that field from the view if the users is not an  
admin, but i suspect this is not very safe because one could fake this  
form.

so the only thing i can think of is taking measures in the controller as  
well. which is not too handy because it is a long form and i use the  
update\_atrributes method.

what i dit is to not include this field in params[:userprofile][:roll]  
but in params[:roll] by using text\_field\_tag instead of tex\_field.

now i can update all my fields with  
@userprofile.update\_params(params[:userprofile])  
and update the roll field by @userprofiel.roll=params[:roll] if  
current\_user.roll==“admin”

what is dislike is that i have to take measures at two places (view and  
controller) which is not very DRY. Are there better ways? perhaps in the  
model?

Regards,

Remco

---

<div class="post-metadata">

**Author:** ![remcoh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/c37758/32.png) [@remcoh](https://www.ruby-forum.com/u/remcoh)\
**Post date:** [July 30, 2008, 1:46pm UTC](https://www.ruby-forum.com/t/field-security-best-practice/144505/2 "2008-07-30T13:46:54Z")

</div>

You’re right, that way it’s not secure.  
Even if you fake around with the form, how would you know, that  
the data that reachs your server was generated using this form?  
Users can throw everything at your server, using simple command line  
tools.

Use attr\_protected instead:

> **[ActiveRecord::Base](https://api.rubyonrails.org/classes/ActiveRecord/Base.html#M001315)**
>
> Active Record Active Record objects don't specify their attributes directly, but rather infer them from the table definition with which they're linked.

Then you get exactly the behaviour you want, the  
attribute can’t be set with update\_attributes, but must  
be set manually with update\_attribute (or similar methods)