params vs. params.permit

account_controller.rb

class AccountController < ApplicationController

  # Just to disable the CSRF protection for specific controller for quick testing
  # @see https://stackoverflow.com/a/34252150/277666
  skip_before_action :verify_authenticity_token


  def test

    # 'params' is NOT recommended to be used directly
    # Imagine in addition to 'id' and 'name', a parameter 'balance' is passed in
    # with the value of 0 (zero), and 'params' is directly used to update a table.

      # rendor json: params


    # 'params' should at least be filtered using params.permit
    # @see https://api.rubyonrails.org/classes/ActionController/Parameters.html#method-i-permit

      render json: create_params

  end


  def create_params
    params.permit(
      :id,
      :name
    )
  end

end

routes.rb

Rails.application.routes.draw do
  post '/account', to: 'account#test'
end