Question

I do NOT have config.active_record.whitelist_attributes = true in application config. And I have attr_protected() in the model class. However, I notice that the id and type attributes are automatically inserted into ActiveModel::MassAssignmentSecurity::BlackList. This makes sense for id attribute since we do not want to set id in a mass assignment, but why this is also true for the type attribute?

Answer 1

The attribute type is used by active record when you are using single table inheritance between active record models, that’s why it’s in the black list. It holds the name of the class that was saved so Rails knows what kind of object was saved.