Just going to leave this here: Rails Security Guide

Ruby on Rails Guides: Ruby On Rails Security Guide

Just going to leave this here: Rails Security Guide

The attacker creates a valid session id: He loads the login page of the web application where he wants to fix the session, and takes the session id in the cookie from the response (see number 1 and 2 in the image). He possibly maintains the session. Expiring sessions, for example every 20 minutes, greatly reduces the time-frame for attack. Therefore he accesses the web application from time to time in order to keep the session alive. Now the attacker will force the user’s browser into using this session id (see number 3 in the image). As you may not change a cookie of another domain (because of the same origin policy), the attacker has to run a JavaScript from the domain of the target web application. Injecting the JavaScript code into the application by XSS accomplishes this attack. Here is an example: <script> document.cookie="_session_id=16d5b78abb28e3d6206b60f22a03c8d9...

Full article: http://guides.rubyonrails.org/security.html

Tweets

@radharc » 06 Mar '12, 8am
Any developer worth their salt should do security audits of their code and pay attention to recommended practices, e.g. [link]
@naoty_k » 06 Mar '12, 5am
githubの問題を機にしっかり読む / “Ruby On Rails Security Guide” [link]
@apocalyptic_AB » 06 Mar '12, 4am
RT @allenwei: Ruby on Rails Guides: Ruby On Rails Security Guide [link]
@allenwei » 06 Mar '12, 4am
Ruby on Rails Guides: Ruby On Rails Security Guide [link]
@eachus » 06 Mar '12, 3am
@bt_deviant That proposed fix for the Github hack is probably somewhat overkill. See [link] section 6 for details.
@naoty_k » 06 Mar '12, 12am
railsguideにもちゃんとmass assignmentのこと書いてあった。ここらへん見直すか。 [link]
@luckydev » 05 Mar '12, 11am
RT @rohitarondekar: @luckydev Just tell people to read [link]
@jjarmoc » 05 Mar '12, 4am
@biosshadow they knew enough about it to include a section in their security guide; [link]
@grasselli » 05 Mar '12, 2am
RT @fnando: I DON'T ALWAYS SECURE MY RAILS APPS, BUT WHEN I DO, I READ THIS GUIDE: [link]
@fnando » 05 Mar '12, 2am
I DON'T ALWAYS SECURE MY RAILS APPS, BUT WHEN I DO, I READ THIS GUIDE: [link]
@dblondeau » 05 Mar '12, 1am
Required reading for every Ruby on Rails developer: [link]
@robconery » 05 Mar '12, 12am
. @kev_nz it's already up. No one reads… [link]
@fcoel » 04 Mar '12, 8pm
RT @ajlopez: Ruby On Rails Security Guide [link]
@Mephux » 04 Mar '12, 8pm
@marshray dude.. READ.. i'm sorry they didn't add it to every page on the website [link]
@nzkoz » 04 Mar '12, 8pm
@toxaq 4.0 defaults to secure nowadays, it's been rectified as best we can given the heritage. You need better sites [link]
@TimHaines » 04 Mar '12, 7pm
RT @mperham: Just going to leave this here: Rails Security Guide [link]
@mperham » 04 Mar '12, 7pm
Just going to leave this here: Rails Security Guide [link]
@iBachue » 29 Feb '12, 7am
Ruby On Rails Security Guide [link] 这篇文章务必精读
@jumph4x » 24 Feb '12, 2pm
Incredibly useful: Rails Security - [link]
@rjzaworski » 16 Feb '12, 10pm
Rails3 Sec guide should be required reading for anyone studying up for their #internetlicense [link]
@cnotin » 06 Feb '12, 10pm
RT @jponge: “@nmartignole: Security guide for a Web App [link] (and this is valid for ANY web app)” +1000
@jponge » 06 Feb '12, 8pm
“@nmartignole: Security guide for a Web App [link] (and this is valid for ANY web app)” +1000
@JohnMeiss » 06 Feb '12, 8pm
Security Guide for Rails Web App [link] (and this is valid for ANY web app) via @nmartignole
@vdubois » 06 Feb '12, 7pm
RT @nmartignole: Security guide for a Web App [link] (and this is valid for ANY web app)
@nmartignole » 06 Feb '12, 7pm
Security guide for a Web App [link] (and this is valid for ANY web app)
@flink91 » 04 Mar '12, 11pm
RT @mperham: Just going to leave this here: Rails Security Guide [link]
@brmichel » 04 Mar '12, 11pm
RT @mperham: Just going to leave this here: Rails Security Guide [link]
@tmilewski » 04 Mar '12, 11pm
RT @mperham: Just going to leave this here: Rails Security Guide [link]
@r38y » 04 Mar '12, 10pm
RT @mperham: Just going to leave this here: Rails Security Guide [link]
@lmpetek » 04 Mar '12, 9pm
RT @ajlopez: Ruby On Rails Security Guide [link]
@LNdata » 04 Mar '12, 8pm
RT @ajlopez: Ruby On Rails Security Guide [link]
@ajlopez » 04 Mar '12, 8pm
Ruby On Rails Security Guide [link]
@jjcall » 04 Mar '12, 7pm
RT @mperham: Just going to leave this here: Rails Security Guide [link]
@capotej » 04 Mar '12, 7pm
RT @mperham: Just going to leave this here: Rails Security Guide [link]
@flemouel » 07 Feb '12, 5am
RT @nmartignole: Security guide for a Web App [link] (and this is valid for ANY web app)
@clacote » 07 Feb '12, 4am
RT @nmartignole: Security guide for a Web App [link] (and this is valid for ANY web app)
@fXzo » 06 Feb '12, 10pm
RT @nmartignole: Security guide for a Web App [link] (and this is valid for ANY web app)
@mickaeljeanroy » 06 Feb '12, 9pm
RT @nmartignole: Security guide for a Web App [link] (and this is valid for ANY web app)
@mejdi_ounissi » 06 Feb '12, 8pm
RT @nmartignole: Security guide for a Web App [link] (and this is valid for ANY web app)