Rails Interview Questions

Common Rails interview questions covering architecture, performance, security, and design patterns. Understanding these deeply — not just the terms — is what interviewers at senior level are looking for.

1. What is "Convention over Configuration" in Rails?

Rails assumes sensible defaults so you only write configuration when deviating from them. A model named Article automatically maps to the articles table, its controller is ArticlesController in app/controllers/articles_controller.rb, views live in app/views/articles/, and the route helper is articles_path. You never declare any of this — the convention handles it. The benefit is less boilerplate and a shared mental model across teams. The tradeoff is that Rails-specific magic can confuse developers unfamiliar with the conventions.

2. What is the N+1 query problem and how do you fix it?

N+1 occurs when you load a collection (1 query) then access an association on each record (N queries). Example: Post.all.each { |p| p.user.name } fires 1 query for posts then 1 per post for users. Fix with eager loading: Post.includes(:user).each { |p| p.user.name } loads all users in a second query. Use includes for most cases (uses 2 queries or LEFT JOIN depending on conditions). Use eager_load when you need to filter/sort by the association (always uses JOIN). Use preload to force separate queries. The Bullet gem detects N+1 in development automatically.

3. What is CSRF and how does Rails protect against it?

Cross-Site Request Forgery tricks authenticated users into unknowingly submitting requests to your app from a malicious site. Rails protects against this with an authenticity token: a unique random token embedded in every form and verified on every non-GET request. ApplicationController includes protect_from_forgery with: :exception by default. The token is stored in the session and compared with the token submitted in the form or the X-CSRF-Token header. API-only apps typically disable this and use stateless token auth (JWT, API keys) instead.

4. What is mass assignment vulnerability and how does Rails prevent it?

Mass assignment lets an attacker set arbitrary model attributes by crafting a request payload — e.g. setting admin: true on user signup. Rails 4+ requires strong parameters: you must explicitly whitelist permitted attributes in the controller using params.require(:user).permit(:name, :email, :password). Anything not whitelisted is filtered out and not passed to the model. This means the model itself is fully protected — you cannot accidentally expose a dangerous attribute just by adding it to the schema.

5. How does ActiveRecord protect against SQL injection?

ActiveRecord uses parameterized queries (prepared statements) for any query using the ? placeholder or hash conditions: User.where("email = ?", params[:email]) or User.where(email: params[:email]). Both are safe. The danger is string interpolation: User.where("email = '#{params[:email]}'") — this directly injects user input into SQL, enabling injection attacks. Always use placeholders or hash conditions. Named placeholders are cleaner for multiple values: User.where("created_at > :since AND role = :role", since: 1.week.ago, role: "admin").

6. What is the difference between concerns, service objects, and helpers?

Concerns (app/models/concerns/, app/controllers/concerns/) are modules that encapsulate shared behavior mixed into multiple models or controllers — they reduce duplication but can hide complexity. Service objects (plain Ruby classes in app/services/) encapsulate complex business logic that does not belong in a fat model or controller — e.g. ProcessOrderService, SendWelcomeEmailService. They are easy to test in isolation. Helpers (app/helpers/) are modules mixed into views for presentational logic like formatting dates or building complex HTML. The general Rails principle is "fat models, skinny controllers" but service objects prevent models from becoming too fat.

7. Asset pipeline vs Importmap vs Webpacker?

Asset Pipeline (Sprockets) — the original Rails approach: concatenates and fingerprints CSS/JS. Simple but limited for modern JS modules. Webpacker — introduced in Rails 5.1, wraps webpack for complex JS apps with npm packages, Babel, React. Deprecated and replaced. Importmap (Rails 7 default) — serves ES modules directly via import maps in the browser, no build step required. npm packages loaded via CDN or vendored. Ideal for most apps that do not need heavy JS processing. jsbundling-rails with esbuild/rollup/bun — when you need npm packages and a fast build step without webpack's complexity. The Rails 7+ recommendation: use importmap-rails for simple apps, jsbundling-rails + esbuild for complex frontend.

8. What is the difference between includes, eager_load, and preload?

All three eager load associations to avoid N+1 but differ in SQL strategy. preload always issues a separate query per association (safe, no joins). eager_load always uses a LEFT OUTER JOIN (single query, enables WHERE/ORDER on association columns). includes is smart: it uses preload by default but switches to eager_load automatically if you reference the association in a where/order clause. Best practices: use includes as your default. Use eager_load explicitly when you need to filter by an association attribute. Use preload when you want to guarantee no JOIN (e.g. to avoid Cartesian product issues with multiple has_many includes).

9. What is Turbo and how does it change Rails development?

Turbo (part of Hotwire, Rails 7 default) enables SPA-like navigation without writing JavaScript. Turbo Drive intercepts link clicks and form submissions, updates only the changed parts of the page over WebSockets or HTTP, maintaining scroll position and browser history. Turbo Frames scope partial page updates to specific regions. Turbo Streams push real-time updates from the server (append/prepend/replace/remove DOM elements) via WebSockets (Action Cable) or SSE. Combined with Stimulus (small JS framework for behavior), Hotwire covers most interactive UI needs without React/Vue, keeping logic on the server in Ruby.