How to securely set parameter for changset without allowing user manipulation?

Hello and welcome,

You might use Ecto.build_assoc instead…

This change my create signature for blog, but I am sure user_id cannot be set via attrs

def create_blog(user, attrs) do
  user
  |> Ecto.build_assoc(:blogs)
  |> Blog.changeset(attrs)
  |> Repo.insert()
end

A simple way is to build the struct with user_id explicitly, and not include it in the cast in the changeset:

%Blog{user_id: current_user.id}
|> Blog.changeset(attrs_from_user)
|> Repo.insert()

Oooo! Ok, so I have always wondered this.

Is there any difference between |> put_assoc(:foo, foo) and %__MODULE__{foo_id: foo.id}? There certainly is if you are doing an update since you then need %__MODULE__{foo | id: foo.id} but it’s still kind of the same thing.

This is just one of those things that I’ve always wondered because I used to always not use put_assoc but then eventually just started using it always. I have never encountered discrepancies between the two versions so I have never been able to confidently say that I know why I’m using one over the other.

You can also manually put changes on a changeset with put_change/3.

defmodule Myapp.Mycontext.Blog do
  def create_changeset(blog, user, attrs) do
    blog
    |> cast(attrs, [:title, :body])
    |> validate_required([:title, :body])
    |> put_change(:user_id, user.id)
  end
end

Wow, I don’t know why I forgot about that, but you’re right, that seems to be by far the easiest way. Thank you!

That also seems like a nice option, thanks!

Alright, that also seems good, thanks!

put_assoc is going to put the new foo_id into changes on the changeset, so that validations etc can see it - the bare struct update won’t do that.