"Application Security for Rails Engineers"
summary
Practical checklist: enable Content Security Policy via Rails 5.2 DSL, deploy as report‑only first, ban 'unsafe‑inline'/'eval', use script hashes; add HSTS with includeSubDomains and preload, X‑Frame‑Options, Referrer‑Policy and strict cache headers. Use Subresource Integrity for CDN assets (Rails asset_helper supports integrity; Webpacker doesn’t yet). Defend forms with reCAPTCHA v3 thresholds (e.g. >=0.7 for low risk), run Brakeman/CI checks, sandbox gem/npm installs and use git hooks/GitHub alerts, and adopt SSH certificates (bless-like CA, short expiries, SSO/MFA).
AI-written summary · about
chapters (15)
- 0:00Introduction to app security
- 1:25Web app security basics
- 2:29Content Security Policy explained
- 7:29Strict Transport Security
- 10:21Frame options and clickjacking
- 11:23Referrer policy and cache control
- 13:25JavaScript security in Rails
- 14:50Subresource Integrity
- 16:35Brute-force attacks and CAPTCHA
- 19:44CSRF and timing attacks
- 21:31Compromised gems and libraries
- 23:58SSH access and certificate rotation
- 28:27Security culture in teams
- 30:12Zero trust architecture
- 31:19Q&A session
