Fix ActiveModel::ForbiddenAttributesError: ActiveModel::ForbiddenAttributesError in Rails

This error occurs when you pass raw params to a model create or update method without going through strong parameters. Rails requires you to call permit on parameters before mass assignment to prevent unauthorized attribute changes. Wrap your params in a method that calls require and permit.

Reading the Stack Trace

Here's what each line means:

• activemodel (7.1.3) lib/active_model/forbidden_attributes_protection.rb:33:in `sanitize_for_mass_assignment': ActiveModel checks whether the attributes hash has been permitted and raises this error if not.
• activerecord (7.1.3) lib/active_record/attribute_assignment.rb:25:in `assign_attributes': The model is trying to assign attributes from an unpermitted parameters hash.
• app/controllers/articles_controller.rb:10:in `create': The create action passes raw params directly to Article.new without calling permit.

Common Causes

def create
  @article = Article.new(params[:article])
  @article.save!
end

def create
  @article = Article.new(params.require(:article))
  # Missing .permit(:title, :body)
  @article.save!
end

def update
  @article = Article.find(params[:id])
  @article.update(params[:article])
end

The Fix

Define a private article_params method that calls require(:article).permit(...) to whitelist only the attributes you want to allow. Use this method everywhere you pass params to model methods.

def create
  @article = Article.new(params[:article])
  @article.save!
end

def create
  @article = Article.new(article_params)
  @article.save!
end

private

def article_params
  params.require(:article).permit(:title, :body, :category)
end

Testing the Fix

require 'rails_helper'

RSpec.describe ArticlesController, type: :controller do
  describe 'POST #create' do
    it 'creates an article with permitted params' do
      post :create, params: { article: { title: 'Test', body: 'Content', category: 'tech' } }
      expect(response).to have_http_status(:created)
      expect(Article.last.title).to eq('Test')
    end

    it 'does not raise ForbiddenAttributesError' do
      expect {
        post :create, params: { article: { title: 'Test', body: 'Content' } }
      }.not_to raise_error
    end
  end
end

Run your tests:

bundle exec rspec spec/controllers/articles_controller_spec.rb

Pushing Through CI/CD

git checkout -b fix/rails-mass-assignment,git add app/controllers/articles_controller.rb,git commit -m "fix: use strong parameters for article mass assignment",git push origin fix/rails-mass-assignment

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: postgres
        ports: ['5432:5432']
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.3'
          bundler-cache: true
      - run: bin/rails db:setup
      - run: bundle exec rspec

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

gem install bugstack

require 'bugstack'

Bugstack.init(api_key: ENV['BUGSTACK_API_KEY'])

Deploying the Fix (Manual Path)

1. Define strong parameter methods for all controllers.
2. Run the test suite to confirm models accept permitted params.
3. Open a pull request.
4. Wait for CI and code review.
5. Merge to main and verify in staging.

Frequently Asked Questions