Securing Your Rails App

on YouTube ↗43m

" summary

Live demos show concrete failures and fixes: a crafted filter string extracted encrypted admin passwords via SQL injection; unchecked form params mass assignment allowed setting admin=true; a raw notes field turned user note into cookie theft with XSS stealing session tokens; unsanitized finds permit voting on others’ events. Remedies are specific: use parameterized queries, model white‑lists, sanitize/whitelist markup not raw, check associations before find, rely on authenticity_token, and enable rack-ssl and secure cookies stop session sniffing.

AI-written summary · about

" chapters (12)

1. 0:00Introduction
2. 2:08Why Rails security matters
3. 7:45Trust boundaries
4. 8:05SQL injection
5. 13:12Mass assignment risks
6. 16:42Timing attacks and sessions
7. 19:49Cross-site scripting
8. 27:12Privilege escalation
9. 31:05Cross-site request forgery explained
10. 35:47Session spoofing and HTTPS
11. 39:13Security best practices
12. 41:25Q&A

" related talks

• 32mSecuring Your Rails AppJim Weirich, Matt Yoho · MountainWest RubyConf 2011
• 34mThe World of Rails SecurityJustin Collins · RailsConf 2015
• 43mSecuring Your SiteThomas Pomfret · RailsConf 2012
• 31mRails Application Security in PracticeBryan Helmkamp · Ruby Midwest 2013
• 31mRails' Insecure DefaultsBryan Helmkamp · RailsConf 2013
• 42mSecuring Your Rails AppMike Nicholaides · Wicked Good Ruby 2013
• 43m...But Doesn't Rails Take Care of Security for Me?Justin Collins · RailsConf 2016
• 55mWeb Application Security: Winning When The Odds Are Against YouBen Dechrai · ScaleConf 2019