@henriquelampert the authorization verification can be done better. Please look the method user_params (line 77). "Permit" should only permit the param :is_admin if the user is an admin, otherwise it shouldn't permit.