plataformatec/devise — Issue #1476: add :role support for mass assignment
Author: erf23
Created: 2011-11-30 18:51:52+00:00
State: open

For added security, it would be convenient if Devise supported roles (via :as) for mass assignment.

Roles are documented here http://api.rubyonrails.org/classes/ActiveModel/MassAssignmentSecurity/ClassMethods.html#method-i-attr_accessible

I would like to be more certain that only Devise is allowed to perform mass-assignment on sensitive User attributes, such as password. A nice way to accomplish this would be to specify in my User:

```ruby

# sensitive attributes cannot be mass-assigned in :default role
attr_accessible :non_sensitive_info

# sensitive attributes can be mass-assigned in :devise role
attr_accessible :password,
:some_info_that_requires_password_to_change,
...other stuff devise needs...,
:as => :devise
```
Then somewhere, we tell devise that it should always use role :devise when performing mass-assignment.

With these changes, we can be certain that only code which specifies role as :devise is allowed to change sensitive fields like password. In theory, this will only be Devise itself.

I acknowledge that there are existing ways to accomplish the same mass-assignment protection, but I think this way is simple. One way is to store less sensitive information into a second model that belongs_to User and never update User in any form. This will be the method I use right now, but it requires an additional model which is a burden for simple apps.