Strong parameters in Ruby on Rails - Cheat Sheet & Quick Revision

Recall & Review

beginner

What are strong parameters in Rails?

Strong parameters are a way to whitelist which attributes can be passed from a form to the controller, helping to prevent unwanted or harmful data from being saved.

beginner

Why do we need to use strong parameters in Rails controllers?

To protect the app from mass assignment vulnerabilities by explicitly allowing only permitted attributes to be updated or created.

beginner

How do you permit a parameter named 'title' inside a strong parameters method?

You use params.require(:model_name).permit(:title) to allow the 'title' attribute.

intermediate

What happens if you try to save a parameter that is not permitted by strong parameters?

Rails will ignore the unpermitted parameter and it will not be saved or updated in the database.

beginner

Show a simple example of a strong parameters method for a 'Post' model with 'title' and 'content' attributes.

def post_params params.require(:post).permit(:title, :content) end

What is the main purpose of strong parameters in Rails?

A To whitelist allowed attributes from user input

B To speed up database queries

C To style forms automatically

D To generate HTML views

Strong parameters whitelist attributes to protect against unwanted data being saved.

Which method is used to specify required parameters in strong parameters?

A permit

B allow

C filter

D require

The require method specifies which parameter must be present.

What will happen if you omit strong parameters in a Rails controller when saving data?

A All parameters will be saved automatically

B The database will be deleted

C Rails will raise an error or ignore unpermitted parameters

D The app will crash immediately

Omitting strong parameters allows all parameters to be mass-assigned, which is a security vulnerability.

How do you permit multiple attributes like 'title' and 'content' in strong parameters?

A permit(:title, :content)

B require(:title, :content)

C allow(:title, :content)

D filter(:title, :content)

The permit method allows multiple attributes by listing them as arguments.

Which of these is a correct strong parameters method for a 'User' model with 'name' and 'email'?

A params.permit(:user).require(:name, :email)

B params.require(:user).permit(:name, :email)

C params.allow(:user).permit(:name, :email)

D params.require(:name, :email).permit(:user)

The correct syntax is to require the model and then permit the attributes.

Explain in your own words why strong parameters are important in Rails applications.

Think about how user input can affect your app's data.

Write a strong parameters method for a 'Comment' model that permits 'author' and 'body' attributes.

Use require and permit methods correctly.