Securing Your Site

on YouTube ↗43m

" summary

Live advice on Rails security with actionable checks: use protect_from_forgery and proper HTTP verbs to stop CSRF, enable Rails’ automatic HTML escaping and set cookies to http_only and secure, generate secrets with rake secret, hash passwords with bcrypt, reset sessions at login and enforce timeouts, prefer whitelist mass assignment via attr_accessible or the slice/strong-params pattern, validate uploaded filenames/types and process images asynchronously (Resque), enable SSL site-wide and harden Nginx ciphers, and avoid leaking server/framework versions or sensitive files.

AI-written summary · about

" chapters (12)

1. 0:00Introduction to web security
2. 2:00SQL injection prevention
3. 4:29Mitigating XSS attacks
4. 9:01Session management best practices
5. 19:45Addressing mass assignment
6. 23:36Direct object references
7. 26:10Cross-site request forgery
8. 29:12Redirection and file uploads
9. 32:57SSL and transport security
10. 34:06Admin and internal security
11. 36:10Server and deployment security
12. 40:04Security resources and tools

" related talks

• 31mRails Application Security in PracticeBryan Helmkamp · Ruby Midwest 2013
• 43mSecuring Your Rails AppJim Weirich, Matt Yoho · Ruby on Ales 2011
• 32mSecuring Your Rails AppJim Weirich, Matt Yoho · MountainWest RubyConf 2011
• 38m"Application Security for Rails Engineers"Alexey Vasiliev · RubyC 2019
• 42mSecuring Your Rails AppMike Nicholaides · Wicked Good Ruby 2013
• 34mThe World of Rails SecurityJustin Collins · RailsConf 2015
• 27mLayered SecurityAaron Bedra · WindyCityRails 2016
• 31mRails' Insecure DefaultsBryan Helmkamp · RailsConf 2013