This code requires that the micropost be valid and tests for the presence of the user_id attribute. We can get these tests to pass with the simple presence validation shown in Listing 10.4.

Now we’re prepared to see why

is wrong. The problem is that by default (as of Rails 3.2.3) all of the attributes for our Micropost model are accessible. As discussed in Section 6.1.2 and Section 9.4.1, this means that anyone could change any aspect of a micropost object simply by using a command-line client to issue malicious requests. For example, a malicious user could change the user_id attributes on microposts, thereby associating microposts with the wrong users. This means that weshould remove :user_id from the attr_accessible list, and once we do, the code above will fail. We’ll fix this issue in Section 10.1.3.