# Is it safe to allow mass assignment of associations?

**URL:** <https://www.ruby-forum.com/t/is-it-safe-to-allow-mass-assignment-of-associations/191947>\
**Category:** Rails\
**Created:** [July 21, 2010, 7:35am UTC](https://www.ruby-forum.com/t/is-it-safe-to-allow-mass-assignment-of-associations/191947 "2010-07-21T07:35:12Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![orotone](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/90db22/32.png) [@orotone](https://www.ruby-forum.com/u/orotone)\
**Post date:** [July 21, 2010, 7:35am UTC](https://www.ruby-forum.com/t/is-it-safe-to-allow-mass-assignment-of-associations/191947/1 "2010-07-21T07:35:12Z")

</div>

Item belongs\_to :user  
attr\_accessible :user

is this safe? Item.user\_id is still protected, and Item.user can’t be  
set by mass assignment from a web request because the parameters are  
all strings - trying to assign a string to Item.user raises  
AssociationTypeMismatch. Even setting params[‘item’][‘user’] to an  
empty string would raise an error.

The benefit of this approach is that I can still use mass assignment  
of associations in my own code.