title: Rails: Sending PUT Request using curl/Postman to update an attribute
body: <p>I was reading Michael Hartl's Rails tutorial book and in the Strong Parameters part it says</p>
  <blockquote>
  <p>a malicious user could send a PATCH request as follows:</p>
  <p>patch <strong>/users/17?admin=1</strong></p>
  <p>This request would make user 17 an admin, which would be a potentially serious security breach.</p>
  </blockquote>
  <p>Then I decided to be a &quot;malicious user&quot; myself so that I could better understand it.</p>
  <p>So I added :admin to the list of permitted attributes in the user controller and used curl in Linux to send a PUT/PATCH request and see in the console if the admin attribute really gets updated by sending the malicious request.</p>
  <pre><code>curl -X PUT http://localhost:3000/users/17?admin=1
  </code></pre>
  <p>Firstly it complained <strong>&quot;Can't verify CSRF token authenticity&quot;</strong>, then I commented out</p>
  <pre><code># protect_from_forgery with: :exception
  </code></pre>
  <p>in the application controller and also eliminated some before_actions simply trying to get it work but I got stuck at the point where it complained</p>
  <pre><code>ActionController::ParameterMissing (param is missing or the value is empty: user):
    app/controllers/users_controller.rb:49:in `user_params'
    app/controllers/users_controller.rb:37:in `update'
  </code></pre>
  <p>I then realized that I might have to pass the user param as a hash of hashes of params to get it work. How do I achieve this in curl or Postman (a chrome REST client)?</p>