Strong parameters in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this controller action with strong parameters?

Consider this Rails controller code snippet. What will be the value of @user after create is called with params containing { user: { name: 'Alice', admin: true } }?

Ruby on Rails

class UsersController < ApplicationController
  def create
    @user = User.new(user_params)
  end

  private

  def user_params
    params.require(:user).permit(:name)
  end
end

A @user will have name 'Alice' and admin set to nil

B @user will have name nil and admin set to true

C @user will have name 'Alice' and admin set to true

D An error will be raised because admin is not permitted

💡 Hint

Think about which parameters are allowed by permit.

The user_params method only permits the :name attribute. The admin attribute is filtered out, so it will not be set on @user. It will be nil or default value.

📝 Syntax

intermediate

Which option correctly permits nested attributes with strong parameters?

You want to permit a post with nested comments attributes in your controller. Which post_params method is correct?

A params.require(:post).permit(:title, comments: [:content, :author])

B params.require(:post).permit(:title, comments_attributes: [:content, :author])

C params.require(:post).permit(:title, :comments => [:content, :author])

D params.require(:post).permit(:title, comments_attributes: :content, :author)

💡 Hint

Remember the naming convention for nested attributes in Rails forms.

When permitting nested attributes for associated models, Rails expects the key to be comments_attributes (with _attributes suffix) if using accepts_nested_attributes_for. Option B uses this correct key and permits an array of attributes.

🔧 Debug

advanced

Why does this strong parameters code fail to update the article?

Given this code, why does calling update fail to update the article attributes?

Ruby on Rails

def update
  @article = Article.find(params[:id])
  @article.update(article_params)
end

def article_params
  params.permit(:title, :body)
end

A Because <code>article_params</code> should use <code>params.require(:article).permit(:title, :body)</code>

B Because <code>params</code> does not require the <code>:article</code> key, so <code>permit</code> is called on the wrong level

C Because <code>params</code> is not permitted at all

D Because <code>permit</code> is missing the <code>:id</code> parameter

💡 Hint

Think about how nested parameters are structured in Rails forms.

Rails expects nested parameters under a key like :article. Without require(:article), permit is called on the top-level params, which lacks the expected keys :title and :body. The permitted params will be empty, so update changes nothing.

❓ state_output

advanced

What is the value of params[:user] after this strong parameters call?

Given this controller snippet, what will params[:user] contain after user_params is called?

Ruby on Rails

def user_params
  params.require(:user).permit(:name, :email)
end

# Assume params = { user: { name: 'Bob', email: '[e-mail]', admin: true } }

A Raises an error because admin is not permitted

B { name: 'Bob', email: '[e-mail]' }

C { name: 'Bob', email: '[e-mail]', admin: true }

D Unchanged original params hash

💡 Hint

Strong parameters return a filtered copy, but do not modify the original params hash.

The permit method returns a new filtered parameters object but does not change the original params hash. So params[:user] remains unchanged.

🧠 Conceptual

expert

Which statement best describes the purpose of strong parameters in Rails?

Choose the most accurate explanation of why Rails uses strong parameters.

A To convert all parameters to strings for consistent processing

B To automatically validate all incoming parameters against the database schema

C To prevent mass assignment vulnerabilities by explicitly allowing only permitted attributes

D To encrypt sensitive parameters before saving them to the database

💡 Hint

Think about security risks when accepting user input in web apps.

Strong parameters are designed to protect applications from mass assignment vulnerabilities by requiring developers to whitelist which attributes can be set through forms or API calls.

Practice

1. What is the main purpose of using strong parameters in a Rails controller?

easy

A. To speed up database queries

B. To style the HTML output

C. To filter and allow only permitted attributes from user input

D. To handle user authentication

Solution

1. Step 1: Understand the role of strong parameters

   Strong parameters are used to control which attributes can be set through forms or API requests.

2. Step 2: Identify the security purpose

   This filtering prevents unwanted or harmful data from being saved, protecting against mass assignment vulnerabilities.

3. Final Answer:

   To filter and allow only permitted attributes from user input -> Option C

4. Quick Check:

   Strong parameters = filter input [OK]

Hint: Strong parameters filter input data to keep app safe [OK]

Common Mistakes:

• Thinking strong parameters speed up queries
• Confusing with styling or authentication
• Ignoring security risks of mass assignment

2. Which of the following is the correct syntax to permit the name and email attributes inside a user_params method?

easy

A. params.require(:user).permit(name, email)

B. params.permit(:user).require(:name, :email)

C. params.permit(:name, :email).require(:user)

D. params.require(:user).permit(:name, :email)

Solution

1. Step 1: Recall the correct order of methods

   The correct pattern is to first require the parent key, then permit the allowed attributes.

2. Step 2: Check the syntax for symbols

   Attributes must be symbols (with colon), so :name and :email are correct.

3. Final Answer:

   params.require(:user).permit(:name, :email) -> Option D

4. Quick Check:

   require then permit with symbols = C [OK]

Hint: Use require first, then permit with symbols [OK]

Common Mistakes:

• Swapping require and permit order
• Using attribute names without colons
• Calling permit before require

3. Given this controller code snippet:

def create
  user = User.new(user_params)
  if user.save
    render json: user
  else
    render json: user.errors
  end
end

def user_params
  params.require(:user).permit(:name, :age)
end

What happens if the incoming params include { user: { name: "Alice", age: 30, admin: true } }?

medium

A. The entire user hash is rejected

B. The admin attribute is ignored and not set on the user

C. An error is raised because admin is not permitted

D. The admin attribute is saved as true

Solution

1. Step 1: Understand permit filtering

   Only :name and :age are permitted, so admin is filtered out.

2. Step 2: Check behavior on extra params

   Extra keys are ignored silently, no error is raised, and only permitted attributes are assigned.

3. Final Answer:

   The admin attribute is ignored and not set on the user -> Option B

4. Quick Check:

   Unpermitted keys are ignored = D [OK]

Hint: Unpermitted keys are ignored, not saved or error [OK]

Common Mistakes:

• Expecting unpermitted keys to be saved
• Thinking unpermitted keys cause errors
• Assuming entire params rejected

4. Identify the error in this user_params method:

def user_params
  params.permit(:name, :email).require(:user)
end

medium

A. require should be called before permit

B. The method should use fetch instead of require

C. The attributes should be strings, not symbols

D. There is no error; the code is correct

Solution

1. Step 1: Recall correct method order

   In strong parameters, require must be called first to get the nested hash.

2. Step 2: Understand method chaining

   Calling permit before require causes an error because permit is called on the whole params, not the nested hash.

3. Final Answer:

   require should be called before permit -> Option A

4. Quick Check:

   require before permit = A [OK]

Hint: Always call require before permit in strong params [OK]

Common Mistakes:

• Swapping require and permit order
• Using strings instead of symbols (not an error)
• Thinking fetch replaces require

5. You want to allow nested attributes for a user's profile with bio and avatar_url. Which user_params method correctly permits this nested data?

hard

A. params.require(:user).permit(:name, profile: [:bio, :avatar_url])

B. params.require(:user).permit(:name, :profile => :bio, :avatar_url)

C. params.require(:user).permit(:name, :profile: [:bio, :avatar_url])

D. params.require(:user).permit(:name, :profile, :bio, :avatar_url)

Solution

1. Step 1: Understand nested attributes syntax

   To permit nested hashes, use a hash with the key and an array of permitted keys inside permit.

2. Step 2: Check each option's syntax

   params.require(:user).permit(:name, profile: [:bio, :avatar_url]) correctly uses profile: [:bio, :avatar_url]. params.require(:user).permit(:name, :profile => :bio, :avatar_url) and C have syntax errors or wrong hash style. params.require(:user).permit(:name, :profile, :bio, :avatar_url) permits keys at top level incorrectly.

3. Final Answer:

   params.require(:user).permit(:name, profile: [:bio, :avatar_url]) -> Option A

4. Quick Check:

   Nested permit uses hash with array = A [OK]

Hint: Use hash with array for nested attributes in permit [OK]

Common Mistakes:

• Passing nested keys as separate symbols
• Using wrong hash rocket syntax inside permit
• Permitting nested keys at top level