It "worked" because `ForbiddenAttributesProtection` thows an error when mass assignment is used with non-whitelisted parameters. When you include that module in the controller, the model is still unprotected (and does not complain). And you never mass assign attributes to the controller, don't you? :)