Nope. I wrote it myself. It was recommend in one of the rails tutorial to avoid passing extra params.

E.g. A user has a flag called admin but a hacker can send an API with admin = true. With .permit in place, you're telling the controller that only allow these fields.