Fix ActionController::UnpermittedParameters: found unpermitted parameters: :admin, :role in Rails

This error means your controller received parameters that are not listed in your strong parameters permit list. Rails blocks unpermitted params to prevent mass assignment attacks. Add the missing parameters to your permit call if they are safe, or remove them from the form if they should not be submitted.

Reading the Stack Trace

Here's what each line means:

• actionpack (7.1.3) lib/action_controller/metal/strong_parameters.rb:292:in `unpermitted_parameters!': Rails raises this error because config.action_controller.action_on_unpermitted_parameters is set to :raise.
• app/controllers/users_controller.rb:42:in `user_params': Your user_params method calls permit without including :admin and :role.
• app/controllers/users_controller.rb:12:in `create': The create action calls user_params which triggers the unpermitted parameters check.

Common Causes

def user_params
  params.require(:user).permit(:name, :email)
  # :admin and :role are submitted but not permitted
end

<%= form_with model: @user do |f| %>
  <%= f.text_field :name %>
  <%= f.email_field :email %>
  <%= f.check_box :admin %>
  <%= f.select :role, ['user', 'admin'] %>
  <%= f.submit %>
<% end %>

# Client sends: POST /users { user: { name: 'Alice', email: 'a@b.com', admin: true, role: 'superadmin' } }
def user_params
  params.require(:user).permit(:name, :email)
end

The Fix

Add :role to the permit list since it is a valid user-editable field. Keep :admin excluded because it is a privileged attribute that should only be set by administrators through a separate admin controller.

def user_params
  params.require(:user).permit(:name, :email)
end

def user_params
  params.require(:user).permit(:name, :email, :role)
  # :admin is intentionally excluded for security
end

Testing the Fix

require 'rails_helper'

RSpec.describe UsersController, type: :controller do
  describe 'POST #create' do
    it 'creates a user with permitted params' do
      post :create, params: { user: { name: 'Alice', email: 'alice@example.com', role: 'editor' } }
      expect(response).to have_http_status(:created)
      expect(User.last.role).to eq('editor')
    end

    it 'ignores admin parameter' do
      post :create, params: { user: { name: 'Alice', email: 'alice@example.com', admin: true } }
      expect(User.last.admin).to be_falsey
    end
  end
end

Run your tests:

bundle exec rspec spec/controllers/users_controller_spec.rb

Pushing Through CI/CD

git checkout -b fix/rails-strong-params,git add app/controllers/users_controller.rb spec/controllers/users_controller_spec.rb,git commit -m "fix: permit role param and keep admin excluded in strong params",git push origin fix/rails-strong-params

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: postgres
        ports: ['5432:5432']
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.3'
          bundler-cache: true
      - run: bin/rails db:setup
      - run: bundle exec rspec

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

gem install bugstack

require 'bugstack'

Bugstack.init(api_key: ENV['BUGSTACK_API_KEY'])

Deploying the Fix (Manual Path)

1. Review which parameters should be user-editable versus admin-only.
2. Update the permit list and add controller tests.
3. Run the full test suite locally.
4. Open a pull request for review.
5. Merge and verify in staging.

Frequently Asked Questions