# How to use Rails Strong Parameters

DevFeed: [How to use Rails Strong Parameters](<https://devfeed.tech/articles/how-to-use-rails-strong-parameters-21053.md>)

Original publisher: [Read original article](<https://jakeyesbeck.com/2015/12/06/how-to-use-rails-strong-parameters/>)

Published: 2015-12-06T12:00:00Z

Content type: tutorial

Language: en

Sources: [Jake Yesbeck](<https://devfeed.tech/sources/jake-yesbeck.md>)

Topics: [Rails](<https://devfeed.tech/topics/rails.md>), [Ruby](<https://devfeed.tech/topics/ruby.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [code](<https://devfeed.tech/tags/code.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [payload](<https://devfeed.tech/tags/payload.md>), [rails](<https://devfeed.tech/tags/rails.md>), [ruby](<https://devfeed.tech/tags/ruby.md>), [ruby-on-rails](<https://devfeed.tech/tags/ruby-on-rails.md>), [safety](<https://devfeed.tech/tags/safety.md>), [validation](<https://devfeed.tech/tags/validation.md>)

## AI overview

This tutorial explains Rails Strong Parameters, including how to require a parameter key and permit specific attributes before mass assignment. It contrasts these protections with an unvalidated controller pattern and warns against permitting all attributes indiscriminately.

## Source excerpt

In the latest major version of Ruby on Rails, Strong Parameters were introduced. The intent of this addition was to enable consistent and reliable parameter checking. Using Strong Parameters is simple and intuitive. It provides a very clean method API to help keep controllers DRY. However, knowing when to use Strong Parameters and how to use them correctly is very important. After all, what good is parameter validation if it is in the wrong place or conveys the wrong message? Hit the Books The trusty "booksandreviews.com" will serve as a good example application. Given a controller that can create Authors, a default pattern without Strong Parameters could look like: class AuthorsController < ApplicationController # POST /authors def create @author = Author.create!(author_params) redirect_to @author, notice: 'Author was successfully created.' end private def author_params params[:author] end end Assuming that there are no presence validations on the Author class itself (or in the form view creating this model), this code has no check to make sure that anything about an Author is passed in to create. This means that any POST request is made to /authors will create a new Author. While this kind of problem would most likely not make it to production, let us assume that the poor people over at "booksandreviews.com" came from such humble code beginnings that this was the first iteration of the AuthorsController. To make the AuthorsController more robust, the require method can be used on the params hash: class AuthorsController < ApplicationController # ... private def author_params params.require(:author) end end Now if a POST to /authors does not contain a payload with an :author key in the body, the request will error: ActionController::ParameterMissing However, a request with the :author attribute will... ActiveModel::ForbiddenAttributesError Also cause an error, apparently. This is another feature of Strong Parameters. The reason an error occurs is that the author_para