Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.Sign up
Deprecate method "match" in routes.rb #5964
My proposal is to announce 'match' method in routes.rb as deprecated and later(e.g. rails 5.0) put it to "private methods" section.
It will encourage people to use "pure" restful methods-verbs like put post get etc and will raise knowledge of their meaning and goal. (GET for retrieving data, POST for state changing requests)
Why? - my points are described at http://homakov.blogspot.com/2012/04/whitelist-your-routes-match-is-evil.html
In the current router DSL, using the +match+ DSL method will match all verbs for the path to the specified endpoint. In the vast majority of cases, people are currently using +match+ when they actually mean +get+. This introduces security implications. This commit disallows calling +match+ without an HTTP verb constraint by default. To explicitly match all verbs, this commit also adds a :via => :all option to +match+. Closes rails#5964