Security best practices in Ruby on Rails - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable strong parameters in a Rails controller.

Ruby on Rails

def user_params
  params.require(:user).[1](:name, :email, :password)
end

Drag options to blanks, or click blank then click option'

Apermit

Bfetch

Callow

Daccept

Attempts:

3 left

💡 Hint

Common Mistakes

Using fetch instead of permit causes errors.

Not using strong parameters can lead to security risks.

The permit method specifies which parameters are allowed for mass assignment, protecting against unwanted data changes.

2fill in blank

medium

Complete the code to protect against Cross-Site Request Forgery (CSRF) attacks in a Rails controller.

Ruby on Rails

class ApplicationController < ActionController::Base
  [1]
end

Drag options to blanks, or click blank then click option'

Aprotect_from_forgery with: :exception

Binclude ActionController::Helpers

Cbefore_action :authenticate_user!

Dskip_before_action :verify_authenticity_token

Attempts:

3 left

💡 Hint

Common Mistakes

Skipping CSRF verification disables protection.

Using unrelated filters does not protect against CSRF.

The protect_from_forgery with: :exception line enables CSRF protection by raising an exception on unverified requests.

3fill in blank

hard

Fix the error in the code to safely escape user input in a Rails view.

Ruby on Rails

<%= [1] %>

Drag options to blanks, or click blank then click option'

Araw @user.name

Bsanitize @user.name

Chtml_safe @user.name

[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using raw or html_safe can cause XSS vulnerabilities.

Not escaping user input risks security.

The sanitize helper cleans user input to prevent injection of harmful HTML or scripts.

4fill in blank

hard

Fill both blanks to configure secure cookies in Rails.

Ruby on Rails

Rails.application.config.session_store :cookie_store, key: '_app_session', secure: [1], httponly: [2]

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

Cnil

Dauto

Attempts:

3 left

💡 Hint

Common Mistakes

Setting secure or httponly to false weakens security.

Leaving these options unset may expose cookies.

Setting secure: true ensures cookies are sent only over HTTPS. httponly: true prevents JavaScript access to cookies, improving security.

5fill in blank

hard

Fill all three blanks to implement Content Security Policy (CSP) headers in Rails.

Ruby on Rails

Rails.application.config.content_security_policy do |policy|
  policy.default_src [1]
  policy.script_src [2]
  policy.style_src [3]
end

Drag options to blanks, or click blank then click option'

A['self']

B['https://trusted.cdn.com']

C['unsafe-inline']

D['none']

Attempts:

3 left

💡 Hint

Common Mistakes

Using ['none'] blocks all content and breaks the app.

Allowing 'unsafe-inline' scripts is risky but sometimes needed for styles.

The CSP configuration restricts sources for content. default_src ['self'] allows content only from the same origin. script_src ['https://trusted.cdn.com'] allows scripts from a trusted CDN. style_src ['unsafe-inline'] permits inline styles when necessary.