Controller params & security
Rails keeps raw request data out of mass assignment through ActionController::Parameters. The lessons show why passing raw params to .new raises ActiveModel::ForbiddenAttributesError and why the permitted? flag starts as false. They cover .permit, which returns an object with only the listed keys. Then comes .require, which steps into the nested key a form submits under. It raises ActionController::ParameterMissing when that key is absent. Real controllers in this project show the pattern, along with params.expect from Rails 8. A sandbox session and the full article_params method close the course.
What you'll learn
- ✓Why raw params passed to .new raise ActiveModel::ForbiddenAttributesError
- ✓How the permitted? flag works and why it starts as false
- ✓Using .permit to keep only the named keys
- ✓Using .require to enter a nested key and catch a missing one
- ✓Reading the require and permit pattern in real controllers, plus params.expect
- ✓Checking params behavior safely in bin/rails console --sandbox
Why raw params can't reach .new
ActiveRecord: creating records and ActionController: actions both named article_params as the safe stand-in for raw params without building it. Here's what happens without it:
Read the full lesson free →Curriculum
7 lessonsWhy raw params can't reach .new
Raw params passed to .new raise ForbiddenAttributesError because the permitted? flag starts as false.
.permit: naming exactly what's allowed
The .permit method returns a permitted object holding only the listed keys, which .new then accepts.
.require: scoping into the right key
The .require method steps into the nested form key and raises ParameterMissing when that key is absent.
The real pattern, verified across this project
Two controllers in this project use require and permit, the same chain that article_params wraps.
A newer syntax already arriving: params.expect
One project file uses params.expect from Rails 8, which joins require and permit in one call.
Trying all of this in a sandbox
The forbidden error, the dropped key and the missing-key exception can be checked in a sandbox console.
Putting it together: article_params, finally opened
The create action and its private article_params method bring every idea of the course into one example.