Ruby best secure code approaches

Hi, This is Shubham Mishra from India,  this is the part of Ruby on Rails exploration journey.  In this post we will discuss about the ruby's some special concepts and I am sure you will get excited to make your hands dirty with those code, so why to wait let's get started...

It's crucial for software engineers to build secure code in addition to functional code. In order to ensure the security of our apps, we will discuss several security best practises in this blog.

1. Avoid SQL Injection

One of the most common security vulnerabilities in web applications is SQL injection. To avoid SQL injection in Ruby, use the built-in parameter binding mechanism provided by your database driver. This ensures that user input is properly escaped and prevents malicious SQL statements from being executed.


In above snippet rather than block A, use block B approach, This way, the name parameter is properly escaped and cannot be used to inject malicious SQL code.

2. Validate User Input

Always validate user input to ensure that it conforms to expected patterns and is within acceptable limits. Use regular expressions or built-in validation methods to ensure that input data is valid. For example, to validate an email address, use the email validation method provided by the ActiveModel module:


This way, you can ensure that the email address provided by the user is valid and prevent malicious input from causing issues.

3. Use Secure Session Management


Web applications need session management to save state between requests. Sessions must be safe, nevertheless, and must not be vulnerable to attacks like session hijacking or session fixation.Use encrypted sessions that are signed and encrypted with a secret key to ensure secure session management in Ruby. For instance, Rails uses ActionDispatch::Cookies::SignedCookieJar to manage sessions securely. By using signed cookies, you ensure that the contents of the session are tamper-proof and secure.

4. Use Strong Passwords


Passwords are often the first line of defense against attackers. To ensure that passwords are secure, use strong password policies and password hashing mechanisms. In Ruby, use the bcrypt gem to hash passwords before storing them in the database. bcrypt is a secure hash algorithm that ensures that passwords are difficult to crack.

5. Keep Dependencies Up-to-date

Finally, keep your Ruby dependencies up-to-date to ensure that you are not using outdated libraries with known vulnerabilities. Use tools like `bundler-audit` to scan your dependencies for known security vulnerabilities.

Finally, implementing these security procedures can significantly increase the security of your Ruby apps. You may lower the possibility of security flaws in your code by using parameter binding, validating user input, employing secure session management, using strong passwords, and keeping dependencies current.

You can explore my previous blog: Ruby 3 type profiling as dynamic data type in ruby

Or you can explore my other blogs too here,
Get to know answers for common search on Google : A blog for posts which can help you for daily life problems, such as where to get free images, Topic suggestion for the blog.

Computer Science algorithms and other knowledge share : A blog for posts such as best search algorithm, Top interview questions for diffrent technologies, knowledge share for some frameworks or programming languages for the interview or in general terms.

My ideas to solve real world problems : A blog where me shared and presented my ideas to solve a real world problems, this will be interesting for me.

Future of computer science technology discussed : A blog where me discussed about the future of computer science and new technologies which will change our way for looking to solve problems.

Ruby on Rails Web development Blog : As the name suggest, it is the blog for sharing few knowledge about RoR web development framework.

Comments

Post a Comment

Popular posts from this blog

Rails Postgresql Query timeout set and skip during migration

Hi, I am  Shubham Mishra  from India,  this is the part of  Ruby on Rails  exploration journey.  In this post we will discuss about the rails DB (Postgresql) query time out setting and how can we avoid this timeout setting during migration and I am sure you will get excited to make your hands dirty with those code, so why to wait let's get started... Question: Rails and postgresql I want to set query timeout to 10 sec but skip to check this timeout setting during rails migration how can i achieve? Answer: To set a query timeout of 10 seconds for PostgreSQL in a Rails application, you can use the statement_timeout configuration option in your database.yml file. Here is an example configuration that sets the query timeout to 10 seconds: This will set the query timeout to 10 seconds for all queries executed by the PostgreSQL adapter in the production environment. To skip checking the query timeout setting during Rails migrations, you can use a custom connection adapter tha
Read more

Rails Sync Postgresql and Elasticsearch Database of a Model

Hi, This is  Shubham Mishra  from India,  this is the part of  Ruby on Rails  exploration journey.  In this post we will discuss about how can we keep Postgresql (a SQLDB) and Elasticsearch (a nonSQL DB) with the help of a background job processor and I am sure you will get excited to make your hands dirty with those code, so why to wait let's get started... Most of the time due to increase in DB record size we try to split our DB into two DB based on the requirement like one is Transaction oriented (SQL DB) and another Search oriented (Non SQL DB) with limited data. In my case we have Postgresql for storing all the records and used for entire business operation and for Search support we have elasticsearch with minimum indexes (tables) and their entire documents. For better understanding lets consider in PG DB we have Employee table with id, name, dob, address etc and some more other tables, whereas in Elasticsearch we have only Employee index (table) with all its documents dupli
Read more

Ruby on Rails configure CORS setting with rack cors gem

Hi, This is  Shubham Mishra  from India,  this is the part of  Ruby on Rails  exploration journey.  In this post we will discuss about the CORS concepts and I am sure you will get excited to make your hands dirty with those code, so why to wait let's get started... What is CORS? Cross-Origin Resource Sharing, sometimes known as CORS, is a security feature built into web browsers that enables web servers to manage which domains can access their resources. It is used to stop rogue websites or programmes from gaining unauthorised access to a web server's resources. In plainer terms, a web browser will submit a CORS request to the server whenever a web application makes a request to a domain other than the one it is currently executing on in order to determine whether it is authorised to access the resources of that domain. The browser can retrieve the resources and show them to the user if the server agrees to the request. Why CORS is important? If CORS is not used, malici
Read more