The security of any software product or application is something that every software solution provider is wary of. It is no different in the case of a Ruby on Rails application.
Even after an application is successfully developed and deployed, there can be possibilities for many unseemly activities.
US-based high-end software solution provider Andolasoft.Inc sheds some light on some of the basic precautions that are worked upon before deploying an application.
The Company’s Ruby on Rails developers pay special attention to security issues in every undertaken venture.
Authentication and authorization of the User model are two different things.
Never miss an update from us. Join 10,000+ marketers and leaders.
Actions like create/update/delete always need to be protected. Even popular plug-ins like Restful authentication and Clearance only authenticate whereas providing no helper methods for authorization.
Mass assignment of sensitive attributes from re-assignment should be protected.
This can be taken care of by disabling mass assignment with the help of attr_accessible or attr_protected in the respective models. Attributes like account_id’s and user_id’ should be protected.
Also disabling updates on protected attributes can be by using attr_readonly so that the Ids don’t get updated once set.
Content types of files being uploaded can be faked, so uploaded files should be placed in protected directories or servers.
Also, file extensions should be checked and the web-server should be disabled so as not to execute such files in the uploaded directories.
Sessions are prone to vulnerabilities like hijacks, replaying cookies, and session fixation. Extra caution must be taken regarding storing data in sessions.
Active record Objects should never be stored in sessions which might change that Object’s behavior while migration and future code change.
The best practice is to only store the ids of the records. Also, sensitive data like User access privileges and money based information should not be stored in sessions.
