Module: Hitch::RegistrationAdmission
- Extended by:
- ActiveSupport::Concern
- Includes:
- RequestAdmission
- Included in:
- RegistrationsController
- Defined in:
- app/controllers/concerns/hitch/registration_admission.rb
Overview
Dynamic Client Registration is an unauthenticated write endpoint. Rails'
controller instrumentation reads request.filtered_parameters before it
runs before_action callbacks, which means a callback cannot honestly cap,
rate-limit, or validate a JSON body before Rails parses it.
This concern participates in ActionController's process_action chain one
level earlier. It admits the request, parses one bounded JSON document with
duplicate keys forbidden, and installs that verified Hash as Rails' cached
request parameters. Instrumentation and the action then reuse the same
object instead of parsing attacker-controlled input a second time.
Constant Summary collapse
- ADMITTED_HEADER =
"hitch.registration_admitted"