# Why can't I hide passed parameters?

**URL:** <https://www.ruby-forum.com/t/why-cant-i-hide-passed-parameters/76450>\
**Category:** Rails\
**Created:** [November 19, 2006, 1:53am UTC](https://www.ruby-forum.com/t/why-cant-i-hide-passed-parameters/76450 "2006-11-19T01:53:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![taylorstrait](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b5a626/32.png) [@taylorstrait](https://www.ruby-forum.com/u/taylorstrait)\
**Post date:** [November 19, 2006, 1:53am UTC](https://www.ruby-forum.com/t/why-cant-i-hide-passed-parameters/76450/1 "2006-11-19T01:53:18Z")

</div>

I don’t want to reveal ‘agreed\_to\_disclaimer\_at’ to users. What am I  
doing wrong?

\<%= link\_to (‘Continue’, { :controller =\> ‘people’,  
:action =\> ‘new’,  
:post =\> true,  
:agreed\_to\_disclaimer\_at =\> Time.now},  
:confirm =\> ‘I agree to terms.’) %\>

\<%= link\_to (‘Continue’, { :controller =\> ‘people’,  
:action =\> ‘new’,  
:method =\> ‘post’,  
:agreed\_to\_disclaimer\_at =\> Time.now},  
:confirm =\> ‘I agree to terms.’) %\>

BOTH return URLs of:

[http://localhost:3000/people/new?post=true&agreed\_to\_disclaimer\_at=Sat+Nov+18+19%3A49%3A49+-0500+2006](http://localhost:3000/people/new?post=true&agreed_to_disclaimer_at=Sat+Nov+18+19%3A49%3A49+-0500+2006)

---

<div class="post-metadata">

**Author:** ![taylorstrait](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b5a626/32.png) [@taylorstrait](https://www.ruby-forum.com/u/taylorstrait)\
**Post date:** [November 19, 2006, 2:05am UTC](https://www.ruby-forum.com/t/why-cant-i-hide-passed-parameters/76450/2 "2006-11-19T02:05:52Z")

</div>

You could always use a button\_to and POST it to the server.

---

<div class="post-metadata">

**Author:** ![taylorstrait](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b5a626/32.png) [@taylorstrait](https://www.ruby-forum.com/u/taylorstrait)\
**Post date:** [November 19, 2006, 2:07am UTC](https://www.ruby-forum.com/t/why-cant-i-hide-passed-parameters/76450/3 "2006-11-19T02:07:52Z")

</div>

Ah I see you are trying to POST it - move the :post option outside of  
the url\_for hash.

\<%= link\_to (‘Continue’, { :controller =\> ‘people’,  
:action =\> ‘new’,  
:agreed\_to\_disclaimer\_at =\> Time.now},  
:confirm =\> ‘I agree to terms.’,  
:post =\> true, ) %\>

---

<div class="post-metadata">

**Author:** ![taylorstrait](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b5a626/32.png) [@taylorstrait](https://www.ruby-forum.com/u/taylorstrait)\
**Post date:** [November 19, 2006, 2:19am UTC](https://www.ruby-forum.com/t/why-cant-i-hide-passed-parameters/76450/4 "2006-11-19T02:19:45Z")

</div>

unknown wrote:

> Ah I see you are trying to POST it - move the :post option outside of  
> the url\_for hash.

That makes sense. But I moved it an it still doesn’t work. Wierd, huh?

\<%= link\_to (‘Continue’, { :controller =\> ‘people’,  
:action =\> ‘new’,  
:agreed\_to\_disclaimer\_at =\> Time.now},  
:post =\> true,  
:confirm =\> ‘I agree to terms.’) %\>

returns:  
[http://localhost:3000/people/new?agreed\_to\_disclaimer\_at=Sat+Nov+18+20%3A20%3A20+-0500+2006](http://localhost:3000/people/new?agreed_to_disclaimer_at=Sat+Nov+18+20%3A20%3A20+-0500+2006)

---

<div class="post-metadata">

**Author:** ![taylorstrait](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b5a626/32.png) [@taylorstrait](https://www.ruby-forum.com/u/taylorstrait)\
**Post date:** [November 19, 2006, 6:39am UTC](https://www.ruby-forum.com/t/why-cant-i-hide-passed-parameters/76450/5 "2006-11-19T06:39:30Z")

</div>

Taylor S. wrote:

> unknown wrote:
> 
> > Ah I see you are trying to POST it - move the :post option outside of  
> > the url\_for hash.
> 
> That makes sense. But I moved it an it still doesn’t work. Wierd, huh?
> 
> \<%= link\_to (‘Continue’, { :controller =\> ‘people’,  
> :action =\> ‘new’,  
> :agreed\_to\_disclaimer\_at =\> Time.now},  
> :post =\> true,  
> :confirm =\> ‘I agree to terms.’) %\>
> 
> returns:  
> [http://localhost:3000/people/new?agreed\_to\_disclaimer\_at=Sat+Nov+18+20%3A20%3A20+-0500+2006](http://localhost:3000/people/new?agreed_to_disclaimer_at=Sat+Nov+18+20%3A20%3A20+-0500+2006)

that first hash is sent to url\_for and url\_for has no idea this is meant  
as a post request. As always, if you want to post invisible data, use a  
form.

\<%= form\_tag :controller =\> ‘people’, :action =\> ‘new’ %\>  
\<%= hidden\_field ‘person’, ‘agreed\_to\_disclaimer\_at’, Time.now %\>  
\<%= submit\_tag ‘Continue’ %\>

---

<div class="post-metadata">

**Author:** ![taylorstrait](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b5a626/32.png) [@taylorstrait](https://www.ruby-forum.com/u/taylorstrait)\
**Post date:** [November 19, 2006, 7:52am UTC](https://www.ruby-forum.com/t/why-cant-i-hide-passed-parameters/76450/6 "2006-11-19T07:52:34Z")

</div>

> that first hash is sent to url\_for and url\_for has no idea this is meant  
> as a post request. As always, if you want to post invisible data, use a  
> form.
> 
> \<%= form\_tag :controller =\> ‘people’, :action =\> ‘new’ %\>  
> \<%= hidden\_field ‘person’, ‘agreed\_to\_disclaimer\_at’, Time.now %\>  
> \<%= submit\_tag ‘Continue’ %\>

I see. Thanks for our help. I guess :method =\> ‘post’ is just for  
grabbing data and not obscuring parameters. Unfortunately,  
ActionController gives me an exception with the new code:

> ‘undefined method `delete’ for Sun Nov 19 01:37:11 -0500 2006:Time’

I’ve read the documentation and assume it is creating some kind of  
object but why would it be trying to call a ‘delete’ method?

---

<div class="post-metadata">

**Author:** ![taylorstrait](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b5a626/32.png) [@taylorstrait](https://www.ruby-forum.com/u/taylorstrait)\
**Post date:** [November 19, 2006, 8:59pm UTC](https://www.ruby-forum.com/t/why-cant-i-hide-passed-parameters/76450/7 "2006-11-19T20:59:15Z")

</div>

Try:

\<%= link\_to (‘Continue’, { :controller =\> ‘people’,  
:action =\> ‘new’,  
:agreed\_to\_disclaimer\_at =\> Time.now},  
{:confirm =\> ‘I agree to terms.’,  
:method =\> ‘post’}) %\>

Vish