An important issue rarely talked about with little documentation on Internet. So, here we go ... a guide to session and cookies in Rails. Session and cookies are an integral part of any good web application and rails has a good support for them. Continuing with our DRY approach, this guide contains link to cool articles with good description wherever necessary.
Table of Contents
- Introduction
- Sessions
- Session in rails
- Configure your sessions
- Storage options
- Session storage limitations
- Session and Security
- HowTo
- Implement session expiration
- Delete stale sessions
- Find out active users
- Access session data using session_id
- Miscellaneous
- Cookies
- Cookie on rails
- cookies vs. request.cookies
- CookieJar
- Miscellaneous
Introduction
HTTP is a stateless protocol which creates problem in uniquely tracking a visitor to a web application. The process of managing the state between browser and server is through the use of session IDs which uniquely identifies a client browser.
Session IDs can be stored and communicated in one of the following ways :
- Embedded in URL
- In form field
- Using cookies.
Information stored between multiple client browser request is called Session Data. Session data for each visitor can be stored at the server or in cookies. Upon client request to server, session data is extracted from session storage using session ID send by client browser. A good common example for session data is user information for authentication.
In the present times, its hard to imagine a good web application not using Sessions.
A wonderful article on implementation techniques of Session ID.
Ruby on Rails does a decent job in handling security concerns in the background. You will have to configure your application to avoid few security attacks while plugins would be required for many security concerns which are not at all or poorly managed by rails.
In this article I have described the security issues related to a ruby on rails web application. I have followed DRY by linking to articles with good explanation and solutions to security concerns wherever required. This guide can also be used as a quick security check for your current web application.
Table of Contents
- Authentication
- Model
- SQL Injection
- Activerecord Validation
- Creating records directly from parameters
- Controller
- Exposing methods
- Authorize parameters
- Filter sensitive logs
- Cross Site Reference(or Request) Forgery (CSRF)
- Minimize session attacks
- Stop spam on your website from DNS Blacklist
- Caching authenticated pages
- View
- Cross site scripting(XSS) attack
- Anti-spam form protection
- Hide mailto links
- Use password strength evaluators
- Miscellaneous
- Transmission of Sensitive information
- File upload
- Secure your setup / environment
- Mysql configuration
- Use good passwords
- Security plugins directory
