Strong parameters: expect
This course covers params.expect in Rails strong parameters. It starts with the array tampering bug: a string where a hash is expected crashes require and permit, and a hash where an array is expected passes through with the wrong shape. The lessons read this app's expect line, explain the double-bracket syntax for arrays of hashes, and show multiple root keys with destructuring. They also cover expect! and Rails' exact class-name status lookup. They then migrate a require/permit controller and compare its output.
What you'll learn
- ✓How expect combines require and permit in one call
- ✓Why tampered payloads crash or slip through require and permit
- ✓The double-bracket syntax for arrays of hashes and empty brackets for scalar arrays
- ✓Multiple root keys in one expect call, destructured into variables
- ✓How expect! differs from expect and why it maps to a 500
- ✓Migrating a require/permit controller and testing valid and missing-key payloads
The bug params.expect exists to fix
Controller params & security ended by setting expect aside: how require and permit work on their own, and how expect's single call replaces both, was left for a dedicated course, this one. Everything that course taught about require and permit still holds. This course is about expect itself.
Read the full lesson free →Curriculum
7 lessonsThe bug params.expect exists to fix
Shows how require and permit crash or return a wrong shape on tampered payloads, and how expect handles both.
One call, both jobs: this app's params.expect line
Reads this app's course_params line and Rails' source, showing expect is built on permit_filters and require.
The double-bracket syntax: pets: [[:name]] means an array of hashes
Explains why expect needs pets: [[:name]] for an array of hashes and tags: [] for scalar arrays.
Multiple root keys in one expect call, destructured directly
Passes several root keys to one expect call, destructures the results, and shows that every key is required.
expect!, and an exact-match quirk in Rails' error handling
Covers expect! and how Rails' exact class-name status lookup turns ExpectedParameterMissing into a 500 response.
Migrating a require/permit controller to expect
Migrates the settings controller to expect, compares outputs, and identifies the controllers that need double brackets.
Putting it together: stricter shape checks, one call instead of two
Reviews the lessons: expect runs require and permit underneath and adds stricter checks on payload shape.