Why security is important
If you are not yet convinced why you should secure your application, read this.
What can happen?
- CNBC Stock Trading Contest Hacked
- A new form of attacks: Tailor-made trojans
- Rails was at risk already once: Anatomy of an attack against 1.1.4
- How: Sniffing in an insecure network such as Wireless LAN, Internet café
- Countermeasures
- Encrypt the traffic using SSL (although HTTPS is slower). However, if parts of the web site are not encrypted, such as the login or index page, the cookie will be transmitted nevertheless. To instruct the browser only to send the cookie over encrypted HTTPS and never over normal HTTP, you have to include the following line in the environment file:
ActionController::Base.session_options[:session_secure] = true - Include additional information (user agent, IP address, …) in the cookie and verify it on each request. When saving the IP-address, you have to bear in mind that there are Internet access providers or large organizations that put their users behind proxies and these might change over the course of a session. Also, the attacker could be in the same local network and so both the victim and the attacker have the same external IP address.
Would you like to comment?
Join Diigo for a free account, or sign in if you are already a member.