Strong parameters in Ruby on Rails - Step-by-Step Execution

Concept Flow - Strong parameters

Receive HTTP request with params

↓

Call controller action

↓

Invoke strong_params method

↓

Permit only allowed keys

↓

Return filtered params

↓

Use filtered params to create/update model

↓

Respond to client

Strong parameters filter incoming request data to allow only safe keys before using them in model operations.

Execution Sample

Ruby on Rails

def create
  user = User.new(user_params)
  if user.save
    render json: user
  else
    render json: user.errors
  end
end

def user_params
  params.require(:user).permit(:name, :email)
end

This code creates a new user only with permitted name and email parameters from the request.

Execution Table

Step	Action	Input Params	Permitted Keys	Filtered Params	Result
1	Receive request	{user: {name: 'Ana', email: '[e-mail]', admin: true}}	N/A	N/A	Params received
2	Call user_params	{user: {name: 'Ana', email: '[e-mail]', admin: true}}	:name, :email	{name: 'Ana', email: '[e-mail]'}	Filtered params returned
3	Create User.new	{name: 'Ana', email: '[e-mail]'}	N/A	N/A	User object initialized with safe params
4	Save user	User object	N/A	N/A	User saved if valid
5	Render response	User saved	N/A	N/A	JSON response sent to client

💡 All params except :name and :email are filtered out to prevent unsafe mass assignment

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
params	{user: {name: 'Ana', email: '[e-mail]', admin: true}}	{name: 'Ana', email: '[e-mail]'}	User object with name and email	User saved or errors
user	nil	nil	User object initialized	User saved or errors

Key Moments - 2 Insights

Why does the admin key not get assigned to the user?

Because in step 2 (user_params), only :name and :email are permitted, so :admin is filtered out and never assigned.

What happens if the required :user key is missing in params?

The require(:user) call raises an error, stopping execution early to prevent unsafe operations.

Visual Quiz - 3 Questions

Look at the execution table at step 2, what keys are included in filtered params?

A name, email, and admin

B name and email

C only admin

D no keys

💡 Hint

Check the 'Filtered Params' column at step 2 in the execution_table

At which step does the code prevent unsafe keys from being assigned to the user?

A Step 2

B Step 1

C Step 3

D Step 4

💡 Hint

Look at the 'Action' column where filtering happens in the execution_table

If we add :admin to the permit list, what changes in the execution table at step 2?

A Params will be empty

B Filtered params will exclude admin key

C Filtered params will include admin key

D Code will raise an error

💡 Hint

Consider how permit affects filtered params in step 2 of the execution_table

Concept Snapshot

Strong parameters filter incoming request data.
Use params.require(:model).permit(:allowed_keys).
Only permitted keys pass to model.
Prevents unsafe mass assignment.
Raises error if required key missing.
Always whitelist keys you trust.

Full Transcript

Strong parameters in Rails protect your app by filtering incoming request data. When a controller action receives params, it calls a method like user_params that requires a key (like :user) and permits only certain keys (like :name and :email). This filtering removes any extra keys, such as :admin, preventing unsafe assignment to the model. If the required key is missing, Rails raises an error to stop unsafe operations. This way, only safe data is used to create or update records, protecting your app from malicious input.