Issues with errors in json context

[djcp]

If you're using strong_parameters for json requests and get an attribute failure on a root attribute, it appears that strong_parameters does not return a json-encoded error message.

  def create
    @notice = Notice.new(notice_params)

    respond_to do |format|
      if @notice.save
        format.html { redirect_to :root, notice: "Notice created!" }
        format.json { head :created, location: @notice }
      else
        format.html { render :new }
        format.json do
          render json: @notice.errors, status: :unprocessable_entity
        end
      end
    end
  end

  def notice_params
     params.require(:notice).permit(:title)
  end

With a strong parameter failure:

$ curl -H "Accept: application/json" -H "Content-type: application/json" 'http://localhost:5000/notices/' -d '{ "notnotice": { "title": "foobar"} }'

Required parameter missing: notice%
$

With a model-level validation failure:

$ curl -H "Accept: application/json" -H "Content-type: application/json" 'http://localhost:5000/notices/' -d '{ "notice": { "bleep": "foo"} }' 

 {"title":["can't be blank"]}
$

I'm not entirely sure of a fix here, perhaps a default json response for these types of errors?

[thomasfedb]

I think the best solution for you would be to add a rescue_from to your controller (or ApplicationController):

rescue_from ActionController::ParameterMissing do |exception|
  render json: {exception.param => "is required"}, status: 422
end

[leonelgalan]

👍 The status code is also 200 (:ok) for the strong param failure. It should be a 422 or 400 in my opinion.

[aesnyder]

Is @thomasfedb the generally accepted way to handle this?

[thomasfedb]

@aesnyder I think its a fairly accepted way to rescue from exceptions in Rails controllers using a rescue_from block, yes.

[aesnyder]

Is there a way to have strong_paramters do nothing when the root element is missing? That way I could just have my model validations handle the rest.

[thomasfedb]

If you don't want an error to be raised if they key is missing, don't use #require. The whole purpose of #require is to assert. You can use #[] instead, e.g. params[:notice].permit(:title).

[aesnyder]

Thanks @thomasfedb!

[thomasfedb]

@fxn @rafaelfranca This can be closed.

[leonelgalan]

@thomasfedb, don't you think the status code should at least be a 4xx and not 200? I agree that the user should rescue from the exception to customize the response, but responding with 200 it's wrong.

[thomasfedb]

Hey @leonelgalan, that's a reasonable suggestion. This repo is only for the compatibility gem, and is designed to match the behaviour of Rails 4+. I'd suggest you check the behaviour of Rails 4+ and submit an issue against rails/rails.

[leonelgalan]

Thanks, I'll put something together a PR and give it a shot! Thanks