Securing Your Rails App

on YouTube ↗32m

" summary

Demonstrates concrete Rails 3 failures: string-interpolated queries allow SQL injection that can dump admin password hashes, unchecked params permit mass-assignment to flip admin flags, and using raw output enables XSS that exfiltrates session cookies (demo injects an <img> request to steal cookies). Shows fixes: use ? parameter binding, declare attr_accessible (whitelist) not attr_protected, use the sanitize helper or Markdown-to-HTML pipeline, rely on Rails’ CSRF authenticity token and serve cookies over SSL.

AI-written summary · about

" chapters (20)

1. 0:00Rails security concerns
2. 1:00Rails apps need security
3. 3:35Rails security features
4. 5:08Web architecture trust boundaries
5. 6:16SQL injection in Rails
6. 9:31SQL injection risks demo
7. 10:56Mass assignment explained
8. 13:27Prevent mass assignment
9. 15:12XSS risks in Rails
10. 16:45XSS attack vectors demo
11. 17:51Session hijacking via cookies
12. 18:54HTML sanitization in Rails
13. 20:39Authorization flaws in queries
14. 21:45Secure data access with associations
15. 22:34Cross-site request forgery protection
16. 24:22Authenticity tokens prevent CSRF
17. 25:47Session spoofing and cookies
18. 27:23Enforce HTTPS with HSTS
19. 29:12Security patches importance
20. 30:23Rails security best practices

" related talks

• 43mSecuring Your Rails AppJim Weirich, Matt Yoho · Ruby on Ales 2011
• 34mThe World of Rails SecurityJustin Collins · RailsConf 2015
• 31mRails Application Security in PracticeBryan Helmkamp · Ruby Midwest 2013
• 43mSecuring Your SiteThomas Pomfret · RailsConf 2012
• 31mRails' Insecure DefaultsBryan Helmkamp · RailsConf 2013
• 37mThe Evolution of Rails SecurityJustin Collins · RailsConf 2018
• 35mTales from the CryptAaron Bedra, Justin Collins, Matt Konda · RailsConf 2014
• 47mEsoteric Web Application VulnerabilitiesAndres Riancho · CODE BLUE 2016