Goal

You’ll be able to build a working form and handle its submission safely using strong parameters, and understand the real security reason strong parameters exist, not just Rails syntax to memorize.

Learn

Rails’ form_with helper builds a form tied to a model:

<%= form_with model: @product do |f| %>
  <%= f.label :name %>
  <%= f.text_field :name %>
  <%= f.label :price %>
  <%= f.number_field :price %>
  <%= f.submit %>
<% end %>

When submitted, this data arrives in the controller’s params, nested under the model name: params[:product][:name], params[:product][:price].

Here’s a genuinely important security practice: Rails requires you to explicitly declare which submitted parameters are actually permitted to be used, called strong parameters:

def create
  @product = Product.new(product_params)
  @product.save
end

private

def product_params
  params.require(:product).permit(:name, :price)
end

Without this explicit permit list, attempting to mass-assign params[:product] directly would raise an error. This is a deliberate security measure: without it, a malicious user could potentially submit extra, unexpected fields in a form request — like an is_admin field the actual form never intended to include — and have them mass-assigned directly onto the model, a real vulnerability class known as mass assignment. Strong parameters force you to explicitly whitelist exactly which fields are genuinely allowed, closing off this attack surface entirely.

Decision Task

A form only includes fields for name and price, but a malicious user manually crafts a request including an extra is_admin=true parameter. Before reading on: without strong parameters explicitly permitting only :name and :price, what real risk does this create?

Show Answer

Without strong parameters, directly mass-assigning params[:product] could potentially set is_admin to true on the model too, even though the actual form never included that field — a genuine security vulnerability called mass assignment. Strong parameters, by explicitly permitting only :name and :price, ensure any extra, unexpected fields like is_admin are simply ignored, regardless of what a malicious request attempts to include.

Common Mistake

Permitting more parameters than a specific action genuinely needs, or worse, attempting to bypass strong parameters entirely for convenience. Strong parameters exist specifically to prevent mass assignment vulnerabilities — the explicit permit list should match exactly what that specific form is actually meant to submit, nothing more, even if it feels like extra typing compared to just permitting everything.

Practice Questions

1. Write a strong parameters method for a Comment model permitting only :body and :author_name.

Show Answer

def comment_params\n params.require(:comment).permit(:body, :author_name)\nend

2. What real security vulnerability do strong parameters specifically prevent?

Show Answer

Mass assignment — a malicious user submitting extra, unexpected fields in a request that could otherwise get directly assigned onto a model without explicit permission.

3. What happens if you attempt to mass-assign params[:product] directly, without calling .permit on it first?

Show Answer

Rails raises an error (ActiveModel::ForbiddenAttributesError), specifically preventing unpermitted mass assignment by default.

4. True or False: strong parameters are just a Rails syntax convention with no real security purpose.

Show Answer

False — they exist specifically to prevent the genuine mass assignment security vulnerability, not just as stylistic convention.

5. Why should a permit list match exactly what a specific form actually needs, rather than permitting more fields “just in case”?

Show Answer

Permitting extra unnecessary fields expands the potential attack surface for mass assignment, defeating the actual security purpose strong parameters are meant to provide.

Try It Yourself

Without looking back, write a strong parameters method for an Order model permitting :customer_name, :total, and :status.

Show Answer

def order_params\n params.require(:order).permit(:customer_name, :total, :status)\nend

Quick Check

1. What does form_with model: @product build?

Show Answer

A form tied to the @product model, appropriately configured for creating or updating it.

2. Where does submitted form data arrive in the controller?

Show Answer

Nested in params under the model name, like params[:product][:name].

3. What are strong parameters?

Show Answer

An explicit whitelist of which submitted parameters are actually permitted to be mass-assigned onto a model.

4. What real vulnerability do strong parameters prevent?

Show Answer

Mass assignment — unexpected extra fields being assigned onto a model without explicit permission.

5. What method is used to declare the explicit permit list?

Show Answer

.permit

تحميل هذا الباب / Download this Chapterنسخة كاملة للدراسة بدون إنترنت، مع الأسئلة والإجابات والصور المتاحة.
PreviousNext