# \#actioncontroller **URL:** https://discuss.rubyonrails.org/tag/actioncontroller/34.md [Latest](https://discuss.rubyonrails.org/latest.md) · [Categories](https://discuss.rubyonrails.org/categories.md) · [Tags](https://discuss.rubyonrails.org/tags.md) --- ## [Wrap all handlers for \`rescue\_from\` inside block](https://discuss.rubyonrails.org/t/wrap-all-handlers-for-rescue-from-inside-block/91690)
**Author:** [@dari-us](https://discuss.rubyonrails.org/u/dari-us)\ **Replies:** 2\ **Last updated:** [October 7, 2026, 11:12am UTC](https://discuss.rubyonrails.org/t/wrap-all-handlers-for-rescue-from-inside-block/91690 "2026-10-07T11:12:10Z")
I am trying to output localized messages to the user inside all rescue\_from blocks, but can’t get it to work. I want to avoid the boilerplate of wrapping each handler inside a I18n.with\_locale block manually. My general … --- ## [Add scheme to token authentication and support DPoP scheme](https://discuss.rubyonrails.org/t/add-scheme-to-token-authentication-and-support-dpop-scheme/91356)
**Author:** [@chad-cole](https://discuss.rubyonrails.org/u/chad-cole)\ **Replies:** 0\ **Last updated:** [July 15, 2026, 3:48pm UTC](https://discuss.rubyonrails.org/t/add-scheme-to-token-authentication-and-support-dpop-scheme/91356 "2026-07-15T15:48:49Z")
I’d like to extend ActionController::HttpAuthentication::Token so controller authentication methods such as authenticate\_or\_request\_with\_http\_token can: restrict authentication to a specific authorization scheme yield … --- ## [\[Proposal\] Add ban\_for: and extend\_ban: options to rate\_limit for blocking longer than the detection window](https://discuss.rubyonrails.org/t/proposal-add-ban-for-and-extend-ban-options-to-rate-limit-for-blocking-longer-than-the-detection-window/91189)
**Author:** [@aglushkov](https://discuss.rubyonrails.org/u/aglushkov)\ **Replies:** 0\ **Last updated:** [June 7, 2026, 2:26am UTC](https://discuss.rubyonrails.org/t/proposal-add-ban-for-and-extend-ban-options-to-rate-limit-for-blocking-longer-than-the-detection-window/91189 "2026-06-07T02:26:40Z")
Context With rate\_limit, how long a client is blocked is the same as the window you measure requests in (within:) — you can’t block for longer than that. Looking at the implementation (rate\_limiting.rb#L72-L90): def rat… --- ## [Expect looks like except](https://discuss.rubyonrails.org/t/expect-looks-like-except/90144)
**Author:** [@schmijos](https://discuss.rubyonrails.org/u/schmijos)\ **Replies:** 1\ **Last updated:** [February 16, 2026, 11:22pm UTC](https://discuss.rubyonrails.org/t/expect-looks-like-except/90144 "2026-02-16T23:22:15Z")
Rails 8 introduced params.expect for ActionController::Parameters . This is really nice piece of functionality. We can now express tight strong params requirements more easily. One thing bugs me though: expect looks lik… --- ## [Testing action with a .rate\_limit](https://discuss.rubyonrails.org/t/testing-action-with-a-rate-limit/88980)
**Author:** [@nicolas-brousse](https://discuss.rubyonrails.org/u/nicolas-brousse)\ **Replies:** 1\ **Last updated:** [September 12, 2025, 2:02am UTC](https://discuss.rubyonrails.org/t/testing-action-with-a-rate-limit/88980 "2025-09-12T02:02:45Z")
Hello, I’m recently looking on how to test .rate\_limit in my application, but I don’t really know how to be able to change the cache\_store for only the test I’m running, since setting the store for all the application o… --- ## [\`before\_action\` / \`skip\_before\_action\` with \`only\` / \`except\` / \`if\` / \`unless\` - nonintuitive and inconsistent](https://discuss.rubyonrails.org/t/before-action-skip-before-action-with-only-except-if-unless-nonintuitive-and-inconsistent/89635)
**Author:** [@maxpleaner](https://discuss.rubyonrails.org/u/maxpleaner)\ **Replies:** 1\ **Last updated:** [August 14, 2025, 4:24am UTC](https://discuss.rubyonrails.org/t/before-action-skip-before-action-with-only-except-if-unless-nonintuitive-and-inconsistent/89635 "2025-08-14T04:24:19Z")
The docs for \_normalize\_callback\_options make it clear that these controller hooks will behave unexpectedly when combining if / unless with only / except: only: :index, if: -\> { true } # the :if option will be ignored… --- ## [\[Proposal\]: Add \`purpose:\` option to \`rate\_limit\` method](https://discuss.rubyonrails.org/t/proposal-add-purpose-option-to-rate-limit-method/89453)
**Author:** [@ArthurPV](https://discuss.rubyonrails.org/u/ArthurPV)\ **Replies:** 5\ **Last updated:** [August 12, 2025, 7:57pm UTC](https://discuss.rubyonrails.org/t/proposal-add-purpose-option-to-rate-limit-method/89453 "2025-08-12T19:57:13Z")
Context A few weeks ago I tried to use the rate\_limit method so that the count could be shared between several controllers, but when I read the source code I noticed that it didn’t seem possible to do that. More precise… --- ## [\[Feature Proposal\] Log when \`before\_action\` raises an exception](https://discuss.rubyonrails.org/t/feature-proposal-log-when-before-action-raises-an-exception/89414)
**Author:** [@swebb](https://discuss.rubyonrails.org/u/swebb)\ **Replies:** 2\ **Last updated:** [June 26, 2025, 5:31am UTC](https://discuss.rubyonrails.org/t/feature-proposal-log-when-before-action-raises-an-exception/89414 "2025-06-26T05:31:52Z")
In development when a before\_action renders or redirects this error message appears on the logs: Filter chain halted as :before\_action rendered or redirected I find this message very helpful. However, if a before\_act… --- ## [Best way to implement user-dependent validations](https://discuss.rubyonrails.org/t/best-way-to-implement-user-dependent-validations/89265)
**Author:** [@dari-us](https://discuss.rubyonrails.org/u/dari-us)\ **Replies:** 2\ **Last updated:** [May 27, 2025, 7:43am UTC](https://discuss.rubyonrails.org/t/best-way-to-implement-user-dependent-validations/89265 "2025-05-27T07:43:30Z")
Say the users of my app are admins of email domains and each of them is allowed to create mailboxes for one or multiple domains by typing out the email address for that mailbox. Currently, the Mailbox-model has an unpers… --- ## [Default status code for \`redirect\_to\` outdated?](https://discuss.rubyonrails.org/t/default-status-code-for-redirect-to-outdated/88990)
**Author:** [@dari-us](https://discuss.rubyonrails.org/u/dari-us)\ **Replies:** 0\ **Last updated:** [April 2, 2025, 7:21pm UTC](https://discuss.rubyonrails.org/t/default-status-code-for-redirect-to-outdated/88990 "2025-04-02T19:21:03Z")
I’ve noticed that when you rails generate scaffold Thing, the actions create and update of ThingsController use the default 302 redirection status code while destroy explicitly uses 303. Is there a particular reason to n… --- ## [Origin and utility of ActionController::Live threads](https://discuss.rubyonrails.org/t/origin-and-utility-of-actioncontroller-live-threads/88947)
**Author:** [@julik](https://discuss.rubyonrails.org/u/julik)\ **Replies:** 4\ **Last updated:** [March 28, 2025, 8:00am UTC](https://discuss.rubyonrails.org/t/origin-and-utility-of-actioncontroller-live-threads/88947 "2025-03-28T08:00:57Z")
I’ve been using Rails (and Rack) for streaming for a long time - in different applications. Oddly enough I have always had difficulties with ActionController::Live, primarily because of its off-threading nature. Just to … --- ## [Best practices for handling an empty value for to\_param's column](https://discuss.rubyonrails.org/t/best-practices-for-handling-an-empty-value-for-to-params-column/88413)
**Author:** [@awilfox](https://discuss.rubyonrails.org/u/awilfox)\ **Replies:** 0\ **Last updated:** [January 12, 2025, 6:55am UTC](https://discuss.rubyonrails.org/t/best-practices-for-handling-an-empty-value-for-to-params-column/88413 "2025-01-12T06:55:52Z")
I have a model that uses a slug column for to\_param. This works fine, including if the user omits it in #new - it fails presence validation. However, if a user purposefully removes the value in #edit, the validation pr… --- ## [The right way to override render method](https://discuss.rubyonrails.org/t/the-right-way-to-override-render-method/84765)
**Author:** [@javier.valencia](https://discuss.rubyonrails.org/u/javier.valencia)\ **Replies:** 2\ **Last updated:** [December 16, 2024, 7:52pm UTC](https://discuss.rubyonrails.org/t/the-right-way-to-override-render-method/84765 "2024-12-16T19:52:08Z")
Hi there, I’m writing a controller concern for HTMX. I need to override ActionController::Base.render method, but I don’t know if this it’s the right way: def render(\*args, &block) options = \_normalize\_render(\*ar… --- ## [Rails 6: replacing render :nothing with head :ok caused a trouble](https://discuss.rubyonrails.org/t/rails-6-replacing-render-nothing-with-head-ok-caused-a-trouble/87676)
**Author:** [@clrsxxx](https://discuss.rubyonrails.org/u/clrsxxx)\ **Replies:** 0\ **Last updated:** [October 14, 2024, 11:45am UTC](https://discuss.rubyonrails.org/t/rails-6-replacing-render-nothing-with-head-ok-caused-a-trouble/87676 "2024-10-14T11:45:37Z")
Hi everyone, I am upgrading a Rails app that contains render :nothing in a controller class. I want to replace this line with head :ok which serves the same purpose. However, this causes me a trouble, since this control… --- ## [Should we use prepend\_before\_action in Rate Limiting?](https://discuss.rubyonrails.org/t/should-we-use-prepend-before-action-in-rate-limiting/86524)
**Author:** [@martinrosso](https://discuss.rubyonrails.org/u/martinrosso)\ **Replies:** 0\ **Last updated:** [September 1, 2024, 8:11pm UTC](https://discuss.rubyonrails.org/t/should-we-use-prepend-before-action-in-rate-limiting/86524 "2024-09-01T20:11:26Z")
I was trying out the new rate limiting feature on a devise controller and found that it wasn’t working as expected because the rate limiting callback was executing after the devise callbacks, so I couldn’t use the rate\_l… --- ## [Add instrumentation for ActionController::Live#send\_stream](https://discuss.rubyonrails.org/t/add-instrumentation-for-actioncontroller-live-send-stream/83705)
**Author:** [@hannahramadan](https://discuss.rubyonrails.org/u/hannahramadan)\ **Replies:** 0\ **Last updated:** [September 14, 2023, 5:13pm UTC](https://discuss.rubyonrails.org/t/add-instrumentation-for-actioncontroller-live-send-stream/83705 "2023-09-14T17:13:50Z")
It was great to see ActionController::Live#send\_stream introduced in Rails 7.0. I’d like to submit a PR to add instrumentation for it. Posting here per CONTRIBUTING guidelines. --- ## [\[CVE-2023-22797\] Possible Open Redirect Vulnerability in Action Pack](https://discuss.rubyonrails.org/t/cve-2023-22797-possible-open-redirect-vulnerability-in-action-pack/82120)
**Author:** [@jhawthorn](https://discuss.rubyonrails.org/u/jhawthorn)\ **Replies:** 0\ **Last updated:** [January 17, 2023, 7:20pm UTC](https://discuss.rubyonrails.org/t/cve-2023-22797-possible-open-redirect-vulnerability-in-action-pack/82120 "2023-01-17T19:20:22Z")
Possible Open Redirect Vulnerability in Action Pack There is a vulnerability in Action Controller’s redirect\_to. This vulnerability has been assigned the CVE identifier CVE-2023-22797. Versions Affected: \>= 7.0.0 Not a… --- ## [Respond\_to: differentiate \*/\* vs. other formats?](https://discuss.rubyonrails.org/t/respond-to-differentiate-vs-other-formats/80546)
**Author:** [@sdubois](https://discuss.rubyonrails.org/u/sdubois)\ **Replies:** 2\ **Last updated:** [May 1, 2022, 12:03pm UTC](https://discuss.rubyonrails.org/t/respond-to-differentiate-vs-other-formats/80546 "2022-05-01T12:03:10Z")
We have an API endpoint called by a legacy client with Accept: \*/\* (1), in which case it should return JSON. This API also needs to respond differently to turbo\_stream requests. How can these be differentiated? In the f…