project_id is accessible which means its open to attack. Users using a command line would be able to assign ratings to an incorrect project or falsify records. Similarly with user_id. However the tutorial ch10.1.3 shows how to create a rating with an association to a user without access to the user_id. Similarly this can be done for project_id but not both.
From tutorial:
@Micropost = user.microposts.build(content: "Lorem ipsum") }
automatically associates a micro post with a user_id
project_id is accessible which means its open to attack. Users using a command line would be able to assign ratings to an incorrect project or falsify records. Similarly with user_id. However the tutorial ch10.1.3 shows how to create a rating with an association to a user without access to the user_id. Similarly this can be done for project_id but not both.
From tutorial:
@Micropost = user.microposts.build(content: "Lorem ipsum") }
automatically associates a micro post with a user_id