great article which totally save my time while I am buliding campus on rails and heading for deployment soon….. thanks!

:-)

For the security minded I recently modified restful_authentication to use bcrypt instead of sha1 (among some other changes):

http://code.google.com/p/acts-as-authentable/

Your a star my good chap

Great, gonna translate it in .fr

Great write up, the more info on security the better.

Great article man, thanks a whole lot.

Just wanted to swing by and thank you for linking to me. Never thought I’d be linked on a site like this :)

SSL Requeriment redirects, which means a login action can in fact travel without encryption. I think Secure Actions (http://agilewebdevelopment.com/plugins/secure_actions) provides a better solution. I explained a couple of tricks for this plugin here (http://www.advogato.org/person/fxn/diary/470.html).

Talking about captchas to prevent automated form submissions: here’s an Inverse Captcha plugin for Mephisto comments. Relies only on CSS (no JS, no user action) and therefor will only work for not-so-critical things like blog comments etc., but does a really good job for these.

Thanks for writing up a short version of my blog articles

Thanks for mentioning my plugin, I appreciate it. I’ve delicious’d this page and I am sure I’ll come back often since I’ve seen great tips already. Thanks!

Aren’t attr_protected and attr_accessible designed to prevent form injection?

The tip linked in your “Creating records directly from parameters” section advises to remove the unwanted keys from the params hash in the controller. Using the protected/accessible methods in the model definition seems to solve the problem much closer to where it is actually happening.

http://rubyforge.org/projects/asgoogleaccount/ is flagged ‘alpha status’, so does anyone know how stable and secure it is? Anyone using in production?

This is a great checklist. Thanks!

Thanks, Quarks! Appreciate that :)

Hi,

I am using Simple Captcha, as explained a good choice here http://www.codeandcoffee.com/2007/06/20/implementing-a-captcha-with-ruby-on-rails-in-10-minutes-or-less/ and at many more places too, in many of my projects and I found it really useful and simplest to implement. Are there specific reasons/flaws that we should not use it ?

Great guide guys keep up the good work.

An excellent article – I’m sure I’m going to get a lot of use out of this. Was a few things I’d not seen/thought of before, particularly the Authorize parameters issue. Thanks for putting this all together =)

Dave

This is a fantastic article. Thanks for putting it together.

Great article! This is an excellent primer to rails security.

Hi,

Your explanation is not justified, even the google’s captcha doesn’t work on two tabs of the browser sharing the session. Moreover your statement that “the plugin is not properly written” just for the reason that you were not able to modify it is not making much sense… the only problem that people are facing is I think the dependency on RMagick as some people finds it hard to install and get working, rest everything seems quite fine.

Anybody else here can suggest any good reason for moving from SimpleCaptcha to anything else ? probably as this site is suggesting ReCaptcha.

This is the best rails security post I’ve ever seen! With your permission, I’ll store in my computer for reference!

Thanks!

Felipe Giotto

@Quark:

That’s fine, and in that case you generate a secure link to your login page with a regular link_to. The point is that you declare secure actions at the controller level, and the regular idioms for link generation get the protocol right.

I think that approach is better than having a redirection. Why would we prefer to have an insecure link and declare a redirection when we can have the right link directly and with the same effort?

Agreed, this is top of the list in security posts for rails!

I’d shout you a beer if you had a link.

SSL Requeriment redirects, which means a login action can in fact travel without encryption. I think Secure Actions (http://agilewebdevelopment.com/plugins/secure_actions) provides a better solution. I explained a couple of tricks for this plugin here (http://www.advogato.org/person/fxn/diary/470.html).

Thanks for very interesting article. I really enjoyed reading all of your posts. It?s interesting to read ideas, and observations from someone else?s point of view? makes you think more. So please keep up the great work.

All the best

This guide is pretty cool and will save a lot of my time.Thanks : )

Is there a way to counter CSRF by checking where the POST came from? Meaning: is there a way to check the host referrer of the POST/GET to make sure it came from the same domain, and if not, then don’t process the request? That seems like the best logical option, if available.

This is an excellent security guide – Thanks.

Those of you using attr_accessible and attr_protected to control mass assignment, one note. Things like “find_or_initialize_by_blah” will be subject to that as well, even though “blah” does not intuitively imply “mass” assignment.

The tricky part is that if attribute “blah” is not in your attr_protected list and at some point you do find_or_initialize_by_blah and no matching object is found (i.e. you hit the “initialize” case), you will happily be handed your new initialized model object, but the “blah” field will silently be set to nil instead of what you expect.

We ended up writing our own mass-setter model methods instead.

Cool article , thank you so much.

thanks for article. looks very interesting.

Thanks for the great article!

I am developing an ROR application where I would like session information to be removed when the browser window is closed (multiple users, same computer). Are there any secure suggestions for doing this?

Thank you!

This is what i was looking for a long time. a security guide on ruby. we all know the security problem with php and we have to take special care on security in ruby as well. Thank for the hard work

Will there be a possibility to collect the cookies from all the well known browsers and put them together in one folder to use them together. is the cookie sotrage the same in IE and in Firefox?

Thanks for the nice article as well from my side. helped me much in understanding! Thomas

I’ve written a Ruby binding to cracklib, which you may find useful for password strength checking:

http://rubyforge.org/projects/rubylibcrack/

I’ve written a Ruby binding to cracklib, which you may find useful for password strength checking:

http://rubyforge.org/projects/rubylibcrack/

Thanks for this guide, i found it very handy and useful. I am going to writing an article on your your on my blog. Great work!

Regards, Meteko

Thanks.. Nice article

Thanks for this good article..

Best Regards

Excellent stuff, Nakul!

Keep it coming! :-)

-Dan

nice. keep the great work up. thx

Hammm… Nice article… Interesting.

Great tutorial, they are very easy to understand. Thanks!

Brilliant tutorial! I think CSRF protection is now included in rails (version 2.2). Does anyone know something about this?

Thanks for the useful article. Best regards…

you expect that the user will be redirected to the main action, preserving all the parameters. But if an attacker adds &host=www.attacker.com to the URL, it will redirect the victim to that host.

1. To find information of an order which belongs to a particular user.

Incorrect :

@order = Order.find(order_id)

Correct :

@order = @user.orders.find(order_id)

i can’t download super simple authentication plugin and generator

I have the same problem. How I can download the plugin and generator? Please help. I must get this.

I can’t download the plugin. Can aynone help me? Thanks in advance. Regards…

I’ve written a Ruby binding to cracklib, which you may find useful for password strength

Excelent work! Extremely useful. Thank you!

Thanks for very interesting article.

Wondering if there are any opinions with regard to a choice between Ruby on Rails versus Cake PHP with regard to security.

Excellent security guide – I did not know about this security risks in ruby.

Security is very important in the work we do0, so thanks for that

Good article.

Thanks Quark for useful comment.

NJ - NY

There are alot of issues that affect the overall security of a web applications. This has been guide has been very helpful. Thanks Quark.

What about server-side code obfuscation (like zend) ? // im nob in ruby

Biggest problem with security is bad passwords, people using the same password, one gets comprmised then they all do.

Cool article , thank you so much.

This is a fantastic article. Thanks for putting it together.

This is an excellent security guide – Thanks.

I am proud of you guys. http://blog.bhushangahire.net/?p=33 .

This way we both will follow each other.

very clear and nice article. thaks for sharing with us Video Youtube | Kuaför Malzemeleri | kiralık ev kiralık daire

Excellent article, thanks. I made a couple of apps in Ruby on Rails and implemented a range of security features similar to the ones outlined above. Please check out our portfolio to find out more. Cheers!

Thank you for the article

Cool article , thank you so much.

Cool aticle. very nice. thanks

Thanks for this guide, i found it very handy and useful.

Thanks for the quality guide!

Thanks for very interesting article.

thanks your post this article is very interesting bayrakçı

Thanks for writing up a short version of my blog articles

Looks very interesting. Thanks for article.

thanks nice

thank you so much

I love this blog! Congratulations!

thank aloat quarkruby

Its easy to manage ‘nil’ values using :allow_nil, its quite handy. For ex: set :allow_nil => true in validates_uniqueness_of to check uniqueness of non-nil values and ignore nil values

Thanks anyway for all the work.

thanx your articles

This guide is pretty cool and will save a lot of my time.Thanks : ) Thanks for writing up a super article here! Greetings hamann

Brilliat information thank you

Yes i also like Ruby on Rails. it has a good potential. so security issue should be added.

Thanks for providing this info

thanks

Hi Guys, this article is a blast and saves us a lot of time for research. Thanks for the great work!

One word Thank you quarkruby

thank you so much. this is nice article.

thank you so much. this is nice article.

Cool aticle. very nice. thanks

thank you so much. this is nice article

dreambox

thank you so much. this is nice article

Very useful (guide) information thank you

This is the best rails security post I’ve ever seen!

Thanks!

Ruby security is an important issue, thanks for the great article

Security is very important in the work we do0, so thanks for that !

V good info

Thanxxx youur articless

Marvelous thank you

Thank you so much.

Thank you

I think that approach is better than having a redirection. Why would we prefer to have an insecure link and declare a redirection when we can have the right link directly and with the same effort?

Thank you for your invaluable help this information will myself very useful

Thank you for your

Thank you for this!

Thanks for the help.

This is an excellent security guide – Thanks.

I am using Simple Captcha and at many more places too, in many of my projects and I found it really useful and simplest to implement.

Ruby on Rails Security Guide thank aloan im the about

Thanks

Ruby security is an important issue, thanks for the great article

Great article man, thanks a whole lot

Thank you so much looks interesting. Happy sharing.

Thank you

Thank you for your help

Thanks, learned quite a bit.

Thank you all

Ruby security is an important issue, thanks for the great article

Thanks so much. It is very helpful and useful.