Securing Rails Applications — Ruby on Rails Guides

This guide describes common security problems in web applications and how to avoid them with Rails. After reading this guide, you will know: How to use the built-in authentication generator. All countermeasures that are highlighted. The concept of sessions in Rails, what to put in there and popular attack methods. How just visiting a site can be a security problem (with CSRF). What you have to pay

[oppara]

Ruby on Rails Security Guide — Ruby on Rails Guides

[side_tana]

へー

[akira_nishii01]

こんなの見つけた。

[yyamano]

Textile Injection. However, even that version has some security bugs, so the countermeasures still apply. Here is an example for version 3.0.4:

[kitokitoki]

session を DB に保存する場合の有効期限

[sessan]

railsのセッションの公式説明。

[naoty_k]

githubの問題を機にしっかり読む

[yaotti]

mass assignment

[yass]

To prevent session hash tampering, a digest is calculated from the session with a server-side secret and inserted into the end of the cookie.

[june29]

Web アプリケーションのセキュリティのお話と、Rails における具体的な対策のお話。

[a2ikm]

ログイン前後のsession fixation対策にはreset_sessionでsession_idを変更する

[atty]

RoR に限らず参考になる

[teppeis]

セキュリティのチェックリストとして

[willnet]

近いうちに全部読む