Ruby Academy · Lesson

Strong Parameters

Safe params.

Strong Parameters is a free Ruby Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ruby Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

The Mass Assignment Problem

Forms send many fields at once. If you blindly pass all of them to a model, an attacker could add fields you never intended, like setting admin: true. This is the mass assignment vulnerability.

User input is never trusted.
You must whitelist allowed fields.
Rails enforces this with strong parameters.

What Are Strong Parameters?

Strong parameters require you to explicitly declare which params a model may accept. Rails raises an error if you try to mass-assign params that were not permitted.

This turns a silent security hole into an opt-in, reviewed list of fields.

require and permit

The pattern uses two methods:

require(:model) ensures the top-level key exists.
permit(:field, ...) whitelists the inner fields.

def article_params
  params.require(:article).permit(:title, :body)
end

Using the Helper

Define a private model_params method and call it where you create or update. Never pass raw params to a model.

def create
  @article = Article.new(article_params)
  @article.save
  redirect_to @article
end

private

def article_params
  params.require(:article).permit(:title, :body)
end

Why a Private Method?

Keeping the whitelist in one private method means:

create and update share the same rules.
The allowed fields are easy to find and review.
It is not exposed as a controller action (private methods are not routable).

What Gets Filtered Out

Any submitted key not in the permit list is dropped before reaching the model. If a form somehow includes admin but you only permit title and body, the admin value is silently ignored, keeping the record safe.

Permitting Arrays

For checkbox lists or multi-selects that send arrays, permit them by passing an empty array as the value. This allows many values for that key.

params.require(:article).permit(:title, tag_ids: [])

Permitting Nested Hashes

For nested attributes (a form that edits a parent and its children at once), permit the nested keys with a hash describing the inner fields.

params.require(:order).permit(
  :customer_name,
  items_attributes: [:product_id, :quantity]
)

Handling Missing Params

If the required key is absent, require raises ParameterMissing, which Rails renders as a 400 Bad Request. This protects actions from malformed requests automatically.

# Missing :article key raises:
# ActionController::ParameterMissing

permit! Is Dangerous

You can call params.permit! to allow everything, but this reopens the mass-assignment hole. Avoid it except in trusted internal contexts. Always prefer an explicit whitelist.

Best Practices

Keep params safe:

Whitelist the minimum set of fields.
Never permit sensitive flags like role or admin from a public form.
Set such fields explicitly in the controller based on server-side logic.

Quick Check

Test your understanding of strong parameters.

Recap: Strong Parameters

You learned to filter input safely:

Mass assignment is a real security risk.
require demands the top key; permit whitelists fields.
Keep the whitelist in a shared private method.
Permit arrays and nested hashes when needed.
Avoid permit! and never permit sensitive flags.

Next we return responses with views and rendering.

Frequently asked questions

Is the “Strong Parameters” lesson free?

Yes — the full text of “Strong Parameters” is free to read here on the web, and the Ruby Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ruby Academy course, upgrade to CoddyKit PRO.

What will I learn in “Strong Parameters”?

Safe params. You practise Ruby Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ruby Academy?

No prior experience is required. Ruby Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Strong Parameters” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ruby Academy lesson?

Yes. Every Ruby Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Ruby Academy