title: ForbiddenAttributesError in Rails 4
body: <p>Im working on upgrading a legacy app to rails 4 and I´m getting an unexplainable (to me at least) <code>ForbiddenAttributesError</code>.</p>
  
  <p>I have whitelisted the params before using them to create a new instance of <code>Station</code> but for some reason I´m still getting
  <code>ForbiddenAttributesError</code>. Is there some way to get more info about which  attribute causes the error?</p>
  
  <hr>
  
  <p>** EDIT. I am using Devise and CanCan. If I remove <code>load_and_authorize_resource</code> the errors are gone (and the authorization as well!). I have tried the solutions on <a href="https://github.com/ryanb/cancan/issues/835" rel="noreferrer">https://github.com/ryanb/cancan/issues/835</a> with no avail.</p>
  
  <hr>
  
  <p>rspec spec/controllers/stations_controller_spec.rb</p>
  
  <pre><code>  1) StationsController POST 'create' invalid should not create a new record
       Failure/Error: post :create, :station =&gt; { :name =&gt; 'foo' }
       ActiveModel::ForbiddenAttributesError:
         ActiveModel::ForbiddenAttributesError
       # ./spec/controllers/stations_controller_spec.rb:67:in `block (5 levels) in &lt;top (required)&gt;'
       # ./spec/controllers/stations_controller_spec.rb:66:in `block (4 levels) in &lt;top (required)&gt;'
  
    2) StationsController POST 'create' valid should create a new record
       Failure/Error: before { post :create, :station =&gt; FactoryGirl.attributes_for(:station, :hw_id =&gt; rand(1000)) }
       ActiveModel::ForbiddenAttributesError:
         ActiveModel::ForbiddenAttributesError
       # ./spec/controllers/stations_controller_spec.rb:73:in `block (4 levels) in &lt;top (required)&gt;'
  
    3) StationsController POST 'create' valid
       Failure/Error: before { post :create, :station =&gt; FactoryGirl.attributes_for(:station, :hw_id =&gt; rand(1000)) }
       ActiveModel::ForbiddenAttributesError:
         ActiveModel::ForbiddenAttributesError
       # ./spec/controllers/stations_controller_spec.rb:73:in `block (4 levels) in &lt;top (required)&gt;'
  </code></pre>
  
  <p>schema.rb</p>
  
  <pre><code>  create_table "stations", :force =&gt; true do |t|
      t.string   "name"
      t.string   "hw_id"
      t.float    "lat"
      t.float    "lon"
      t.datetime "created_at", :null =&gt; false
      t.datetime "updated_at", :null =&gt; false
      t.string   "timezone"
      t.float    "balance"
      t.integer  "user_id"
      t.boolean  "down"
    end
  </code></pre>
  
  <p>station_controller.rb</p>
  
  <pre><code>      ...
        # POST /stations
        # POST /stations.xml
        def create
          @station = Station.new(station_params)
          @station.set_timezone!
          logger.debug("@station " + @station.inspect)
          respond_to do |format|
            if @station.save
              format.html { redirect_to(@station, :notice =&gt; 'Station was successfully created.') }
              format.xml  { render :xml =&gt; @station, :status =&gt; :created, :location =&gt; @station }
              format.yaml { render :status =&gt; :ok, :nothing =&gt; true }
            else
              # create users list if the station cannot be created
              @users = User.all_users_select(current_user)
              format.html { render :action =&gt; "new" }
              format.xml  { render :xml =&gt; @station.errors, :status =&gt; :unprocessable_entity }
              format.yaml { render :status =&gt; :unprocessable_entity, :nothing =&gt; true }
            end
          end
        end
  
        ...
  
        # whitelists params for mass assignment
        def station_params
          params.require(:station).permit(
              :user_id, :name, :hw_id, :measures, :lat, :lon, :authenticity_token, :commit
          )
        end
  </code></pre>
  
  <p>station_controller_spec.rb</p>
  
  <pre><code>      describe "POST 'create'" do
          describe "invalid" do
            it "should not create a new record" do
              expect do
                post :create, :station =&gt; { :name =&gt; 'foo' }
              end.to_not change(Station, :count)
            end
          end
  
          describe "valid" do
            before { post :create, :station =&gt; FactoryGirl.attributes_for(:station, :hw_id =&gt; rand(1000)) }
            it "should create a new record" do
              expect do
                post :create, :station =&gt; FactoryGirl.attributes_for(:station, :hw_id =&gt; rand(1000))
              end.to change(Station, :count)
            end
            subject { response }
            it { should redirect_to station_path(assigns(:station)) }
          end
        end
  </code></pre>
  
  <p>factories/station.rb</p>
  
  <pre><code>    FactoryGirl.define do
        factory :station do
          name "Test Staton"
          hw_id Time.now.to_s
          lat 63.401839
          lon 13.072183
        end
        factory :invalid_station, class: Station do
          name nil
        end
      end
  </code></pre>
  
  <p>models/station.rb</p>
  
  <pre><code>#include Geokit::Geocoders
  class Station &lt; ActiveRecord::Base
    #acts_as_mappable :default_units =&gt; :kms,
     #                  :lat_column_name =&gt; :lat,
     #                  :lng_column_name =&gt; :lon
    belongs_to :user
    has_many :measures, :dependent =&gt; :destroy
    has_one :current_measure, :class_name =&gt; "Measure"
  
    # arduino client has not memory enough to post the station name so it cannot be required!
    validates :hw_id, :presence =&gt; true # must have a hw_id
    validates :hw_id, :uniqueness =&gt; true # and the hw_id must be unique
  
    # Geocoder gem attribute mapping
    geocoded_by :name, :latitude  =&gt; :lat, :longitude =&gt; :lon
  
    def owned_by?(owner)
      user==owner
    end
  
    def calibrate_speed(speed)
      speed/250
    end
  
    def self.send_low_balance_alerts
      stations = Station.find(:all)
      stations.each do |station|
        logger.info "Checking station #{station.name}"
        logger.info "Last measure at #{station.current_measure.created_at}"
        if station.balance/100 &lt; 15 &amp;&amp; !station.down
          if !station.user.nil?
            logger.info "Send reminder to owner #{station.user}"
            UserMailer.notify_about_low_balance(station.user, station).deliver
          end
        end
      end
    end
  
    def self.send_down_alerts
      stations = Station.find(:all)
      stations.each do |station|
        logger.info "Checking station #{station.name}"
        logger.info "Last measure at #{station.current_measure.created_at}"
        if station.current_measure.created_at &lt; 15.minutes.ago &amp;&amp; !station.down
          station.down = true
          station.save
          if !station.user.nil?
            logger.info "Send reminder to owner #{station.user}"
            UserMailer.notify_about_station_down(station.user, station).deliver
          end
        end
      end
    end
  
    def self.get_timezone(lat, lon)
      timezone = Timezone::Zone.new :latlon =&gt; [lat, lon]
      timezone.active_support_time_zone
    end
  
  
  
    def set_timezone!
      if (!self.lat.nil? &amp;&amp; !self.lon.nil?)
        self.timezone  = Station.get_timezone(self.lat, self.lon)
      end
    end
  
  end
  </code></pre>