OWASP Top 10 for Rails developers
summary
Covers OWASP Top 10 with concrete Rails fixes: explains server‑side request forgery examples (external and internal), recommends validating user URLs, network segregation and log monitoring; details authentication fixes using Devise/ROTP, password checks with the pwned API, and rate limiting via Rails 7.2 built‑in rate limiter or rack‑attack on older apps; points to dependency scanning with dependabot or bundler‑audit and lists vulnerable Rails APIs (railsqli.org) and concrete SQL injection pitfalls to fix now.
AI-written summary · about
chapters (13)
- 0:00Introduction to OWASP Top 10
- 1:07Server Side Request Forgery
- 3:15Security Logging and Monitoring
- 4:18Authentication Failures
- 5:44Rails Security Implementations
- 8:15Rate Limiting in Rails
- 8:36Vulnerable Dependencies
- 9:20Security Misconfigurations
- 10:02Insecure Design
- 10:25SQL Injection Risks
- 12:36Cryptographic Failures
- 13:20Broken Access Control
- 14:47Closing and Resources
related talks
31mRails Application Security in Practice
31mRails' Insecure Defaults
34mThe World of Rails Security
43mSecuring Your Site
01h 02mUnderstanding the OWASP Top 10
51mHarmonizing the OWASP API and Application Top 10 Lists
42mSecuring Your Rails App
01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017