title: RSpec - Testing strong parameters
body: <p>I am using the <code>strong_parameters</code> gem in my controllers, but I'm having a hard time understanding how I would test it.</p>
  
  <p>Here's an example of my setup</p>
  
  <pre><code>class UserController &lt; ActionController::Base
    include ActiveModel::ForbiddenAttributesProtection
  
    def create
      @user = User.new(user_params)
      if @user.save
        ...
      end
    end
  
    private
    def user_params
      params.require(:user).permit(:first_name, :last_name, :username, :email)
    end
  end
  </code></pre>
  
  <p>I want to test the <code>user_params</code> method to make sure that it is correctly filtering out malicious key/value pairs, but can't figure out how to do it.  Has anyone else been through this?</p>