Is it possible to change params through web? - ruby-on-rails

Question

I am coding a website, that have no legit option for editing users.
Once created, nothing can be changed.
And here is my question:
Is it possible to change users data (for example by sending patch requests) without using edit form (because I did not create one), by 3rd party (a.k.a. not host)?
As Rails 5 requires, I am using strong params (sending user name and password when creating user by signup form).
#routes
Prefix Verb URI Pattern Controller#Action
root GET / sessions#new
signup GET /signup(.:format) users#new
POST /signup(.:format) users#create
login GET /login(.:format) sessions#new
POST /login(.:format) sessions#create
logout DELETE /logout(.:format) sessions#destroy
users GET /users(.:format) users#index
POST /users(.:format) users#create
new_user GET /users/new(.:format) users#new
edit_user GET /users/:id/edit(.:format) users#edit
user GET /users/:id(.:format) users#show
PATCH /users/:id(.:format) users#update
PUT /users/:id(.:format) users#update
DELETE /users/:id(.:format) users#destroy
Should also mention that there is no update method, but I am using
resources :users

Answer 1

For third party access to your db you probably need an API.
Simplified example:
You app's URL is https://myapp.example.com/.
config/routes.rb:
namespace :api do
namespace :v1 do
resources :users, only: [:update]
end
end
rake routes:
Prefix Verb URI Pattern Controller#Action
api_v1_user PATCH /api/v1/users/:id(.:format) api/v1/users#update
PUT /api/v1/users/:id(.:format) api/v1/users#update
app/controllers/api/v1/base_controller.rb:
class Api::V1::BaseController < ActionController::Base
# Prevent CSRF attacks by raising an exception.
protect_from_forgery with: :null_session
end
app/controllers/api/v1/users_controller.rb:
class Api::V1::UsersController < Api::V1::BaseController
def update
# check params, maybe look for some security tokens
user = User.find(params[:id])
if user
user.update_attribute(:name, params[:name])
render plain: "success" and return
else
render plain: "failure" and return
end
end
end
Then request like this
curl -X PATCH https://myapp.example.com/api/v1/users/1?name=new_name
would change users' with id = 1 name by "new_name".
For proper API desing you may check http://jsonapi.org/.