rails 4 strong params session

Question

I am using a custom passwordless login for my app. A user simply needs to enter their username or email, and then a unique login link with a token is sent to them. They enter their username or email into a simple form :

<%= form_tag request_token_path, id:'login-form' do %>
     <%= text_field_tag :user_id %>
<% end %>

This posts to a sessions#request_token method which verifies whether that user exists and then sends along the login link.

def request_token
   lookup = session_params[:user_id]
   if lookup.include? '@'
     @user = User.find_by(email: lookup)
   else
     @user = User.cached_find(lookup)
   end
   if @user
     @user.send_login_link
     redirect_to login_path, notice: "#{@user.username.capitalize} your email was sent!"
   else
     redirect_to login_path, notice: "Whoops! Looks like #{lookup} is not registered on this site. Please check spelling or signup!"
   end
 end

My question is that in my SessionsController file I defined the sessions_params

private
def session_params
  params.require(:session).permit(:user_id,:auth_token)
end

I know that means that I have to use a session object or in order to pass along the :user_id from the form since I defined :user_id as a param that is on valid as an attribute of a session. I am wondering the correct way to do this. Making a new session object doesn't make sense since that isn't even a model I have but is it safe to just take it from the params?

and instead make lookup = params[:user_id] ?

Answer 1

If you have a session object that responds to user_id attribute, you need to create the form for that object specifically:

<%= form_for @session do |f| %>
    <%= f.text_field :user_id %>
<% end %>

If that's not the case, and you need to stick to form_tag, try making the attribute name something that would come up in the controller as a session hash:

<%= text_field_tag "session[user_id]" %>

When you do

params.require(:session)

it means you're requiring your params hash to have a session key, which in turn should have the permitted user_id attribute:

{params: {session: {user_id: "something"}}

And thats why you'd need form_for @session OR the textfield with the suggested "session[user_id]" name