Strong parameters in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this controller action with strong parameters?

Consider this Rails controller code snippet. What will be the value of @user after create is called with params containing { user: { name: 'Alice', admin: true } }?

Ruby on Rails

class UsersController < ApplicationController
  def create
    @user = User.new(user_params)
  end

  private

  def user_params
    params.require(:user).permit(:name)
  end
end

A @user will have name 'Alice' and admin set to nil

B @user will have name nil and admin set to true

C @user will have name 'Alice' and admin set to true

D An error will be raised because admin is not permitted

💡 Hint

Think about which parameters are allowed by permit.

The user_params method only permits the :name attribute. The admin attribute is filtered out, so it will not be set on @user. It will be nil or default value.

📝 Syntax

intermediate

Which option correctly permits nested attributes with strong parameters?

You want to permit a post with nested comments attributes in your controller. Which post_params method is correct?

A params.require(:post).permit(:title, comments: [:content, :author])

B params.require(:post).permit(:title, comments_attributes: [:content, :author])

C params.require(:post).permit(:title, :comments => [:content, :author])

D params.require(:post).permit(:title, comments_attributes: :content, :author)

💡 Hint

Remember the naming convention for nested attributes in Rails forms.

When permitting nested attributes for associated models, Rails expects the key to be comments_attributes (with _attributes suffix) if using accepts_nested_attributes_for. Option B uses this correct key and permits an array of attributes.

🔧 Debug

advanced

Why does this strong parameters code fail to update the article?

Given this code, why does calling update fail to update the article attributes?

Ruby on Rails

def update
  @article = Article.find(params[:id])
  @article.update(article_params)
end

def article_params
  params.permit(:title, :body)
end

A Because <code>article_params</code> should use <code>params.require(:article).permit(:title, :body)</code>

B Because <code>params</code> does not require the <code>:article</code> key, so <code>permit</code> is called on the wrong level

C Because <code>params</code> is not permitted at all

D Because <code>permit</code> is missing the <code>:id</code> parameter

💡 Hint

Think about how nested parameters are structured in Rails forms.

Rails expects nested parameters under a key like :article. Without require(:article), permit is called on the top-level params, which lacks the expected keys :title and :body. The permitted params will be empty, so update changes nothing.

❓ state_output

advanced

What is the value of params[:user] after this strong parameters call?

Given this controller snippet, what will params[:user] contain after user_params is called?

Ruby on Rails

def user_params
  params.require(:user).permit(:name, :email)
end

# Assume params = { user: { name: 'Bob', email: '[e-mail]', admin: true } }

A Raises an error because admin is not permitted

B { name: 'Bob', email: '[e-mail]' }

C { name: 'Bob', email: '[e-mail]', admin: true }

D Unchanged original params hash

💡 Hint

Strong parameters return a filtered copy, but do not modify the original params hash.

The permit method returns a new filtered parameters object but does not change the original params hash. So params[:user] remains unchanged.

🧠 Conceptual

expert

Which statement best describes the purpose of strong parameters in Rails?

Choose the most accurate explanation of why Rails uses strong parameters.

A To convert all parameters to strings for consistent processing

B To automatically validate all incoming parameters against the database schema

C To prevent mass assignment vulnerabilities by explicitly allowing only permitted attributes

D To encrypt sensitive parameters before saving them to the database

💡 Hint

Think about security risks when accepting user input in web apps.

Strong parameters are designed to protect applications from mass assignment vulnerabilities by requiring developers to whitelist which attributes can be set through forms or API calls.