Rails and attr_accessible + security

Question

I'm not sure i completely understand security and the attr_accessible. Why are any attributes considered safe for mass assignment? One thing is being able to set an Admin attribute to true, or something like that. But why is it considered safe to eg make a users email accessible? Isn't it, potentially, just as bad?

Answer 1

Well this is a long winded debate, and perhaps this question belongs on https://security.stackexchange.com/ but regardless...

The simple rule of thumb to follow is:

Any parameter you are willing to accept from a user input directly and save it to the data base can be made attr_accessible .

Any parameter which the user should not be able to change via a form post, like email or is_admin, etc should not be.

If you have attributes which need to be conditionally validated or allowed, like only admin can set something, even then they should not be listed in the attr_accessible list.