rails/rails — Issue #3453: Default to whitelist mode for mass assignments
Author: igrigorik
Created: 2011-10-27 20:42:15+00:00
State: open

Rails is all about smart defaults, yet even as noted in the current security guide we are opening a wide open hole by not enforcing whitelist mode for mass assignments: http://edgeguides.rubyonrails.org/security.html#mass-assignment

As per the recommendation at the end of the linked section, apps should start by default with:

```ruby
config.active_record.whitelist_attributes = true
```

So, the functionality is there, it's more a question of flipping the flag on the default. Is this something that is being discussed for future releases, and if not, what are the roadblocks towards making this the default behavior?