Ruby on Rails Security Cheatsheet - The Diigo Meta page

• 12 Oct 10
  

  Ron Rabakukk

  RoR

• 04 May 09
  

  Rodrigo de Oliveira

  Lista de itens pra ficar ligado ao desenvolver aplicações Ruby on Rails, de maneira segura

  cheat_sheet compilação csrf dica rails ruby segurança from_delicious

• 15 Jul 08
  

  Maciej Szczytowski

  rails security

• 07 Jul 08
  

  dani-el

  security rails reference cheatsheet howto guide

• 26 May 08
  

  rail security delicious

• 26 Mar 08
  

  zeroeth

  rails security

• 21 Mar 08
  

  Ramon Tayag

  cheatsheet rails security

• 09 Feb 08
  

  Piotr Golabek

  webapp_blogs

• 24 Jan 08
  

  Dirk Jende-Holzmann

  rails security

• 22 Jan 08
  

  Thorn Vandevelde

  webdevelopment rubyonrails security cheatsheet xss reference

• 30 Dec 07
  

  Carlos Rafael .

  security rails rubyonrails programming reference development

• 16 Dec 07
  

  Thomas Neumann

  rails security cheatsheet reference delicious

• 09 Dec 07
  

  Harjeet Singh

  rails ruby security

  • Ruby on Rails Security Cheatsheet

     
     
    Why security is important
     
    If you are not yet convinced why you should secure your application, read this.
     
    What can happen?
     
     
    • CNBC Stock Trading Contest Hacked
     
    • A new form of attacks: Tailor-made trojans
     
    • Rails was at risk already once: Anatomy of an attack against 1.1.4
     
     
     
    Sessions
     
    Session hijacking: Session hijacking is a class of attacks where an attacker gets hold of a session identifier (cookie) of another user. Consequently, he gets access to the web application, because the session identifier serves as temporary login credential. 
     
    • How: Sniffing in an insecure network such as Wireless LAN, Internet café
     
    • Countermeasures
     
    • Encrypt the traffic using SSL (although HTTPS is slower). However, if parts of the web site are not encrypted, such as the login or index page, the cookie will be transmitted nevertheless. To instruct the browser only to send the cookie over encrypted HTTPS and never over normal HTTP, you have to include the following line in the environment file:
      ActionController::Base.session_options[:session_secure] = true
     
    • Include additional information (user agent, IP address, …) in the cookie and verify it on each request. When saving the IP-address, you have to bear in mind that there are Internet access providers or large organizations that put their users behind proxies and these might change over the course of a session. Also, the attacker could be in the same local network and so both the victim and the attacker have the same external IP address.
  • Ruby on Rails Security Cheatsheet

  • Ruby on Rails Security Cheatsheet

     
     

    Why security is important

     

    If you are not yet convinced why you should secure your application, read this.

     

    What can happen?

     

     
    • CNBC Stock Trading Contest Hacked
     
    • A new form of attacks: Tailor-made trojans
     
    • Rails was at risk already once: Anatomy of an attack against 1.1.4
     

     

     

    Sessions

     

    Session hijacking: Session hijacking is a class of attacks where an attacker gets hold of a session identifier (cookie) of another user. Consequently, he gets access to the web application, because the session identifier serves as temporary login credential. 

     
    • How: Sniffing in an insecure network such as Wireless LAN, Internet café
     
    • Countermeasures
     
    • Encrypt the traffic using SSL (although HTTPS is slower). However, if parts of the web site are not encrypted, such as the login or index page, the cookie will be transmitted nevertheless. To instruct the browser only to send the cookie over encrypted HTTPS and never over normal HTTP, you have to include the following line in the environment file:
      ActionController::Base.session_options[:session_secure] = true
     
    • Include additional information (user agent, IP address, …) in the cookie and verify it on each request. When saving the IP-address, you have to bear in mind that there are Internet access providers or large organizations that put their users behind proxies and these might change over the course of a session. Also, the attacker could be in the same local network and so both the victim and the attacker have the same external IP address.
     
    • Create a new session when someone successfully logs in. Use reset_session to do that. However you have to copy all data from the old session to the new one (e.g. :user_id).
     
    • Invalidate the session when someone logs out. For example session[:user_id] = nil
     

     

    Session fixation: These attacks focus on fixing a user's session identifier known to the attacker, and forcing the user's browser and the web application into using this identifier. That way the attacker can use the session, when the victim logs in (more…).

     

     
    • Countermeasures
     
    • Create a new session when someone successfully logs in (see above).
     

     

    Generators and plugins for authentication.

  1 more annotation...

• 21 Nov 07
  

  fourdee

  Script Help Ruby on Rails

• 15 Nov 07
  

  Joao Vitor Guimaraes

  ruby security rubyonrails cheatsheet

• 14 Nov 07
  

  Aníbal Rojas

  cheatsheet cheatsheets rails rubyonrails security tips tutorial reference links resources

• 

  A. D.

  cheatsheet rails security

• 

  Phil Despotos

  rails security reference cheatsheet

• 11 Oct 07
  

  josephhsu

  security rails ruby rubyonrails cheatsheet programming

• 

  ruby-and-rails

• 

  Alberto Sesena

  security rubyonrails

• 09 Oct 07
  

  Eduard Bondarenko

  security rails ruby rubyonrails cheatsheet programming reference documentation development cheat

• 06 Oct 07
  

  cheatsheet rubyonrails security rails

• 

  Anton Hipertracker

  cheatsheet rubyonrails security rails

• 03 Oct 07
  

  Javier Alonso Gómez

  rails

• 

  cinefilo

  rubyonrails seguridad cheatsheet chuleta ingles

• 27 Sep 07
  

  pangel

  rails security

• 

  Alan Ho

  security rubyonrails rails ruby cheatsheet programming hack

• 26 Sep 07
  

  manalang

  good pointers on securing your rails app

  security rails ruby rubyonrails cheatsheet programming reference documentation hacking

• 

  E Young

  rails

• 

  Seymour Cakes

  security web rails

• 

  Mark Gardner

  security rails Ruby rubyonrails cheatsheet programming reference

• 25 Sep 07
  

  Iecker

  hacker

• 

  loopion loopion

  security rails rubyonrails ruby cheatsheet programming reference documentation

• 

  Alban Peignier

  rails security

• 

  Tatsuya ISHIDATE

  security rails ruby rubyonrails cheatsheet reference programming documentation tips sysadmin document tutorials

• 

  jeremiah hester

  cheatsheet rails ruby rubyonrails security reference programming imported

• 

  Steve Verlinden

  rails security

• 

  kdmsnr

  rails security cheatsheet _later

• 

  Chrys R

  ruby rails security cheatsheets programming

• 

  Joel Liu

  rails security

• 

  krypton pc

  rubyonrails

• 

  Chris Grant

  documentation rails rubyonrails security programming cheatsheet reference toread

• 

  jschoolcraft

  security rails RubyOnRails reference

• 24 Sep 07
  

  miles woodroffe

  security rails

Would you like to comment?

Join Diigo for a free account, or sign in if you are already a member.