Another step that isn’t strictly necessary at this stage—but is a really good idea nevertheless—is to tell Rails which attributes of the model are accessible, i.e., which attributes can be modified by outside users (such as users submitting requests with web browsers).
That's not what attr_accessible means --- the real meaning of attr_accessible is subtly different in a way that leads people to make mistakes. attr_accessible means attributes can be modified automatically based on user input. End-user web browser requests can modify things that aren't in attr_accessible --- you just have to write the code to let them.
The error this leads to is overly-permissive attr_accessible statements, because people fall into a trap of believing anything that might be changed as a direct result of a user request must be in the attr_accessible statement.
Another step that isn’t strictly necessary at this stage—but is a really good idea nevertheless—is to tell Rails which attributes of the model are accessible, i.e., which attributes can be modified by outside users (such as users submitting requests with web browsers).
That's not what attr_accessible means --- the real meaning of attr_accessible is subtly different in a way that leads people to make mistakes. attr_accessible means attributes can be modified automatically based on user input. End-user web browser requests can modify things that aren't in attr_accessible --- you just have to write the code to let them.
The error this leads to is overly-permissive attr_accessible statements, because people fall into a trap of believing anything that might be changed as a direct result of a user request must be in the attr_accessible statement.