def create
    @order = current_client.orders.new(order_params)
    begin
        @order.save!
        products = params[:products]
        products.each do |product_hash|
            @order.products.create!(product_hash)
        end
    rescue
        return head :bad_request
    end
end

create 的時候發生 ForbiddenAttributesError

products 是嵌套在 order 的 JSON 裡面的數組

{
    "xxx" : "xxxxxx",
    "products": [
        {
            "xxx": "xxxx",
        }
    ]
}