Security Issues Related to Ruby on Rails Applications
March 14, 2011
Security of any software product or application is something which every software solution provider is wary of. It is no different in the case of a Ruby on Rails application. Even after an application is successfully developed and deployed, there can be possibilities for many unseemly activities. US based high end software solution provider Andolasoft.Inc sheds some light on some of the basic precautions that are worked upon before deploying an application. The Company’s Rails developers pay special attention to security issues in every undertaken venture.
Authentication and authorization of User model are two different things. Actions like create/update/delete always need to be protected. Even popular plug-ins like Restful authentication and Clearance only authenticate whereas providing no helper methods for authorization.
Mass assignment of sensitive attributes from re-assignment should be protected. This can be taken care of by disabling mass assignment with the help of attr_accessible or attr_protected in the respective models. Attributes like account_id’s and user_id’ should be protected. Also disabling updates on protected attributes can be by using attr_readonly, so that the Ids don’t get updated once set.
Content types of files being uploaded can be faked, so uploaded files should be placed in protected directories or servers. Also file extensions should be checked and the web server should be disabled so as not to execute such files in the uploaded directories.
Sessions are prone to vulnerabilities like hijacks, replaying cookies and session fixation. Extra caution must be taken regarding storing data in sessions. Active record Objects should never be stored in sessions which might change that Object’s behavior while migration and future code changes. Best practice is to only store the ids of the records. Also sensitive data like User access privileges and money based information should not be stored in sessions.