You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> You can also include the concern only in the controllers you seem fit. Adding the concern to the `ApplicationController` is a "forget about it" approach.
41
-
42
24
---
43
25
44
26
## Usage
45
27
46
-
You can encode your parameters with a `sign_param` helper method. Specify which params you want to decode by specifying them in the `has_signed_params` class method.
28
+
The signed paramaters can be accesed via `params.signed`. It mirrors the behavior of Rails' [signed cookies](https://api.rubyonrails.org/classes/ActionDispatch/Cookies.html).
29
+
30
+
Similarly, setting a signed parameter can be done with the `params.sign` method.
47
31
48
32
#### Example
49
33
50
34
```ruby
51
35
classRecordsController < ApplicationController
52
-
has_signed_params :record_ids, only::index
53
-
54
36
defindex
55
-
# The record_ids param is automatically decoded
56
-
@records=Record.find(params[:record_ids])
37
+
38
+
# Using `params.signed` will return `nil` if the parameter is tampered
39
+
record_ids = params.signed[:record_ids]
40
+
41
+
# Using `params.signed.fetch` will raise `ActionController::Parameters::InvalidSignature` if the parameter is tampered
42
+
record_ids = params.signed.fetch(:record_ids)
43
+
44
+
@records=Record.find(record_ids)
57
45
end
58
46
59
47
defnew_public_link
60
48
record_ids =Record.last(8).pluck(:id)
61
-
encoded_record_ids = sign_params(record_ids)
62
-
# Your controller action logic that generates shareable public links
> You can use all sorts of datatypes when signing parameters. Strings, integers, arrays, objects - they all just work.
56
+
67
57
> [!CAUTION]
68
58
> Avoid exposing sensitive data while using `signed_params`. Your application should still implement proper authentication and authorization.
69
59
70
60
---
71
61
72
-
## Configuration
73
-
74
-
`signed_params` uses Rails' [ActiveSupport::MessageVerifier](https://api.rubyonrails.org/classes/ActiveSupport/MessageVerifier.html) under the hood to encode the params. You can adjust the secret used for encoding by adding an initializer.
0 commit comments