Rails Application Security in Practice

on YouTube ↗31m

" summary

Covers concrete risks and mitigations: session hijacking fixed by force SSL everywhere, cookie secure and HttpOnly flags and strict-transport-security; password storage moves from SHA1 to bcrypt or scrypt because 2009 rigs compute 3 billion SHA-1s/sec; use Rails strong parameters to prevent mass assignment, protect_from_forgery for CSRF, avoid unsafe ActiveRecord calls like pluck/calculate that allow SQL injection, sanitize attributes to stop XSS (watch link_to hrefs), and run Brakeman (or Code Climate security monitor) for static checks.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 0:42Security Issues
3. 2:10Overview
4. 3:20Session Hijacking
5. 4:37Countermeasures
6. 8:16Brute Force Attacks
7. 12:24Insecure Direct Object Reference
8. 16:07Mass Assignment
9. 19:35Crosssite request forgery
10. 22:07Rails sequel injection
11. 25:17Crosssite scripting

" related talks

• 34mThe World of Rails SecurityJustin Collins · RailsConf 2015
• 43mSecuring Your SiteThomas Pomfret · RailsConf 2012
• 32mSecuring Your Rails AppJim Weirich, Matt Yoho · MountainWest RubyConf 2011
• 43mSecuring Your Rails AppJim Weirich, Matt Yoho · Ruby on Ales 2011
• 42mSecuring Your Rails AppMike Nicholaides · Wicked Good Ruby 2013
• 38m"Application Security for Rails Engineers"Alexey Vasiliev · RubyC 2019
• 31mRails' Insecure DefaultsBryan Helmkamp · RailsConf 2013
• 20mDefending Against Data Breaches, as a Practicing Ruby DeveloperFrank Rietta · Rocky Mountain Ruby 2015