Because ror 4.2 is used, the correct way is to add your virtual attributes to :permit(:virtual attribute name)

I haven’t used erb much, but are you sure that this method will be called in the template? password= I am used to using
callbacks for this kind of needs...before_create

Ruby on Rails does not need to write attr_accessor directly.

But you need to use strong-parameters. Refer to the following writing method and add password to the whitelist:
http://edgeguides.rubyonrails.org/action_controller_overview.html#stro...