How can I achieve white listing of all attributes in Sails.js to avoid mass assignment security mistake?

Question

Sails.js provides blueprint routes for GET, PUT, POST, DELETE which are mapped to find/findOne, update, create and destroy actions of the controller. Now, I recently read this article about the functionality of white listing attributes in Rails, which tells which attributes can be updated via mass update, which also secures the API from surprise changes.

I am trying to find out if there is some functionality like that in built in Sails ?

Did you give a try to my answer? Do you want clarifications? — Alexis N-o, Aug 18 '15 at 14:10

score 2 · Accepted Answer · edited May 23 '17 at 11:51

I don't think that sails has this functionality. You'll probably have to override the blueprint methods in the controllers to declare the white list there.

You could also implement this functionality by overriding the update blueprint. You could had some code that looks for a attr_accessible attribute in the model and clean the values.

Have a look at this answer to see how to override blueprints.

How can I achieve white listing of all attributes in Sails.js to avoid mass assignment security mistake?

1 Answers1