The World of Rails Security
summary
Overview of concrete Rails security issues and fixes: historical behavior of mass-assignment and strong parameters, real XSS and CSRF examples (including a TweetDeck-style XSS), demos of SQL injection via ActiveRecord and a public SQLi playground, how session cookies are structured so they can be decoded and why cookie session store (versus encrypted session cookies) is risky, surprising default choices (server‑side sessions not default, JSON not escaped), and practical tools and automation: rack‑attack, secure_headers, and Brakeman/Brakeman in CI. Practical, example‑driven, and focused on fixes.
AI-written summary · about
chapters (32)
- 0:00Intro
- 0:24Announcement
- 2:11Cross Site Scripting Protection
- 2:53Rails 3/4 Examples
- 4:35Lots of Safe(ish) Helpers
- 5:07Cross Site Request Forgery (CSRF)
- 7:43Mass Assignment Protection
- 8:38Strong Parameters
- 10:23Security Headers
- 11:40Back to Cross Site Scripting
- 12:16JSON Encoding in Rails 3.2
- 12:50How About Contextual Encoding?
- 13:45Not Great CSRF Protection
- 14:43CSRF Token Failures
- 15:36Why Care?
- 16:54Server-Side Sessions Not Default
- 17:32So What?
- 18:31Decoding Cookies
- 19:15No Account/Session Management
- 19:48No Authorization Framework
- 20:38Not Enough SQL Injection Protection
- 23:01Manual SQL Escaping
- 23:12Sanitizing SQL?
- 25:48No Open Redirect Protection
- 26:12No Protocol Filtering for Links
- 27:03Even More Missing Security Features
- 27:57Learn About Security
- 28:16Use Security Libraries
- 28:53Use Static Analysis Tools
- 29:31Cost of Fixing Defects
- 31:06The Plan
- 31:44Some Options
