Moderate Parameters: The Path From Protected Attributes to Strong Parameters
Tags: rails, showdev, gem
Published: 2019-04-24 22:08:11

_Originally published on [Hint's blog](https://hint.io/blog/moderate-parameters)._

We all know Strong Parameters isn't exactly cutting edge technology in 2019. It was originally introduced in Rails 3.2 (March 20, 2012) and was made the default/standard in 4.0 (June 25, 2013).

![image](https://thepracticaldev.s3.amazonaws.com/i/9qyd7fvs06wbjrabzowu.png)

Even with Strong Parameters 7 years in the rear view mirror, there was still legacy security support in the form of the `protected_attributes` gem. However, with the release of Rails 5, this gem was officially unmaintained.

Based on our [UpgradeRails](https://www.upgraderails.com) experience helping clients move to the latest and greatest versions of Rails, this is still a large technical hurdle that many teams face.

With this in mind, we built a tool that allows for safe and confident migration to strong parameters.

We call it Moderate Parameters.

## Here's How It Works

Moderate Parameters is a tool that provides safety nets and logging of data sources in the controller by extending `ActionController::Parameters` functionality.

Add the gem ([repo](https://github.com/hintmedia/moderate_parameters)/[rubygems](https://rubygems.org/gems/moderate_parameters)) to your application's Gemfile:

```ruby
gem 'moderate_parameters'
```

Then, inside of the recommended strong parameters private method, replace `permit` with `moderate` and add a little context:

_(Note:_ `controller_path` _and_ `action_name` _need to be included as shown. They are methods that provide naming context for the logger.)_
```ruby
class UsersController < ActionController::Base

. . .

private

# def user_params
#   params.require(:user).permit(:email, :first_name, . . .)
# end

  def user_params
    params.require(:user).moderate(controller_path, action_name, :email, :first_name, . . .)
  end
end
```

And...that's it.

Moderate Parameters will begin logging controller context and parameter keys that have not yet been whitelisted. This means that, in the above example, if you forgot to include `:last_name` in the list of permitted parameters while creating a user, your log would look like this:

```log
Users#create is missing :last_name from the permitted parameters
```

## Test Like You Fly

We have built Moderate Parameters to be deployed to production. This way we can ensure that all parameters are being accounted for every controller in the entire Rails app. Data will still flow through the app as expected, with the added benefit of painting a clear picture of what moving to Strong Parameters looks like.

Once the full parameter list has been clearly outlined (meaning your Moderate Parameters logs are empty), switching over to Strong Parameters is as easy as swapping `moderate` for `permit`:

```ruby
class UsersController < ActionController::Base

. . .

private

  def user_params
    params.require(:user).permit(:email, :first_name, :last_name)
  end

# def user_params
#   params.require(:user).moderate(controller_path, action_name, :email, :first_name, :last_name)
# end
end
```

## We Can Help!

We have built up a set of services that can run alongside Moderate Parameters in production to procedurally parse and generate exactly what Strong Parameters should look like.

If Strong Parameters or something like it is preventing you or your team from enjoying the latest in Rails security and features, let us help you ensure your success. Our team has decades of experience helping teams turn unmanageable upgrades into cutting-edge products taking advantage of all that Rails has to offer.