Rails' Insecure Defaults

on YouTube ↗31m

" summary

Rails lists concrete insecure defaults and practical fixes: leaking exact Ruby/Rack versions in the Server header, binding dev servers to 0.0.0.0, SQL logs exposing filtered values, committing secret_token.rb to git, unsafe open redirects, link_to allowing javascript: URIs, pluck and other AR APIs accepting raw SQL fragments, and YAML deserialization risks. Each item includes an exploit consequence and a remediation — for example bind Rails to localhost and redact SQL-bound values or gitignore secret_token.rb and default to JSON serialization — with code-level options to opt into less safe behavior.

AI-written summary · about

" chapters (10)

1. 0:00Start
2. 0:52Insecure by default is insecure.
3. 2:25Let's Talk About Insecure Defaults
4. 3:09Verbose Server Header
5. 6:38Avoid loading real data into development environments
6. 7:03Logging SQL Values
7. 9:39Versioned Secret Tokens
8. 11:13Minimum: Git-ignore secret_token.rb in generated app skeleton
9. 16:39Rails is not a SQLi silver bullet
10. 23:29Thank You @brynary

" related talks

• 32mSecuring Your Rails AppJim Weirich, Matt Yoho · MountainWest RubyConf 2011
• 31mRails Application Security in PracticeBryan Helmkamp · Ruby Midwest 2013
• 34mThe World of Rails SecurityJustin Collins · RailsConf 2015
• 43mSecuring Your Rails AppJim Weirich, Matt Yoho · Ruby on Ales 2011
• 37mThe Evolution of Rails SecurityJustin Collins · RailsConf 2018
• 16mOWASP Top 10 for Rails developersGreg Molnar · Friendly.rb 2024
• 43mSecuring Your SiteThomas Pomfret · RailsConf 2012
• 42mSecuring Your Rails AppMike Nicholaides · Wicked Good Ruby 2013