title: Rails 4 - Switching from protected attributes to strong parameters
body: <p>I followed the <a href="http://railscasts.com/episodes/250-authentication-from-scratch" rel="nofollow noreferrer">rails cast tutorial</a> for user authentication/registration/login which apparently has an outdated method of using the gem protected attributes. I found that it's necessary to switch to strong parameters and did so by following <a href="https://stackoverflow.com/a/19130224/2739431">this method</a>. </p>
  
  <p>I had to delete the <code>attr_accessible</code> code from my user.rb model (commented out below) and was wondering if there's anything else I should do instead of just defining user params within the controller. Should there be attr_accessors for the user's fields (email, password, location) now that I don't have the attr_accessible or is this unnecessary? I'm new to rails and do not fully understand the proper necessities for user authentication.</p>
  
  <p><strong>user.rb</strong></p>
  
  <pre><code>class User &lt; ActiveRecord::Base
    #attr_accessible :email, :password, :password_confirmation, :location
  
    attr_accessor :password, :location
    before_save :encrypt_password
  
    validates_confirmation_of :password
    validates_presence_of :password, :on =&gt; :create
    validates_presence_of :email
    validates_uniqueness_of :email
  
    def self.authenticate(email, password)
      user = find_by_email(email)
      if user &amp;&amp; user.password_hash == BCrypt::Engine.hash_secret(password, user.password_salt)
        user
      else
        nil
      end
    end
  
    def encrypt_password
      if password.present?
        self.password_salt = BCrypt::Engine.generate_salt
        self.password_hash = BCrypt::Engine.hash_secret(password, password_salt)
      end
    end
  end 
  </code></pre>
  
  <p><strong>user_controller.rb</strong></p>
  
  <pre><code>class UsersController &lt; ApplicationController
    def new
      @user = User.new
    end
  
    def create
    @user = User.new(user_params)
    if @user.save
      redirect_to root_url, :notice =&gt; "Signed up!"
    else
      render "new"
    end
    end
  
    #add thing from https://stackoverflow.com/a/19130224/2739431
    private
      def user_params
        params.require(:user).permit(:email, :password, :password_confirmation, :location)
      end
  
  end
  </code></pre>