Security best practices in Ruby on Rails - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Cross-Site Request Forgery (CSRF) and how does Rails protect against it?

CSRF is an attack where unauthorized commands are sent from a user that the web application trusts. Rails protects against CSRF by including an authenticity token in forms and verifying it on the server side to ensure requests are genuine.

beginner

Why should you use parameter filtering in Rails logs?

Parameter filtering hides sensitive data like passwords or credit card numbers from appearing in logs. This prevents accidental exposure of private information if logs are accessed by unauthorized users.

beginner

What is SQL Injection and how does Rails prevent it?

SQL Injection is when attackers insert malicious SQL code through user input to manipulate the database. Rails prevents this by using parameterized queries and Active Record methods that safely escape inputs.

beginner

How does Rails help prevent Cross-Site Scripting (XSS) attacks?

Rails automatically escapes HTML in views to prevent malicious scripts from running. This means user input is treated as plain text, not executable code, protecting users from XSS attacks.

beginner

What is the purpose of using HTTPS in Rails applications?

HTTPS encrypts data sent between the user and the server, protecting sensitive information from being intercepted. Rails encourages HTTPS by providing easy ways to enforce secure connections.

Which Rails feature helps protect against CSRF attacks?

A Automatic SQL escaping

B Encrypted cookies

C Authenticity token in forms

D Session timeout

Rails includes an authenticity token in forms to verify requests come from trusted sources, preventing CSRF.

How does Rails prevent SQL Injection?

A Enforcing HTTPS

B By escaping HTML in views

C Filtering parameters in logs

D Using parameterized queries with Active Record

Rails uses parameterized queries and Active Record methods to safely handle user input and prevent SQL Injection.

What does Rails do to protect against Cross-Site Scripting (XSS)?

A Escapes HTML in views automatically

B Filters sensitive parameters in logs

C Encrypts database fields

D Uses authenticity tokens

Rails escapes HTML in views by default to prevent malicious scripts from running, protecting against XSS.

Why is it important to filter sensitive parameters in Rails logs?

A To prevent sensitive data exposure

B To enable HTTPS

C To reduce database size

D To speed up logging

Filtering sensitive parameters prevents private data like passwords from appearing in logs, protecting user privacy.

What is the main benefit of using HTTPS in a Rails app?

A Faster page loads

B Encrypted data transfer

C Automatic CSRF protection

D Simpler code

HTTPS encrypts data between the user and server, protecting sensitive information from interception.

Explain how Rails protects against common web attacks like CSRF, SQL Injection, and XSS.

Think about how Rails handles user input and form submissions.

Describe why filtering sensitive parameters in logs and using HTTPS are important security practices in Rails.

Consider what could happen if logs or data transmissions are not secured.