How to Ensure RoR-based App Security Using Best Coding Practices

As you plan the roadmap for your web project, resistance to security threats should be at the top of your priorities. Whether you’re upgrading your existing Ruby on Rails app or creating a new one, your motivations are guided by customer trust and government regulations.

Here, I want to delve into the best coding practices that can help you protect your app from an ever-growing list of threats.

Built-in Security Features of Ruby on Rails

It’s important to know your enemy, but it’s just as important to know yourself and your own capabilities. There are a number of built-in security features of Ruby on Rails that can help you mitigate those threats and protect your web applications.

Let’s dive deeper into the key built-in security features of Ruby on Rails.

1. Protection Against Cross-Site Scripting (XSS)

   Cross-Site Scripting (XSS) is an attack vector where a malicious actor can inject scripts into web pages viewed by other users. To protect against XSS, Ruby on Rails automatically escapes user-generated content. When data is rendered in views, Ruby on Rails encodes it to ensure that potentially malicious scripts are displayed as plain text, preventing the attack from doing any harm.

2. Prevention of Cross-Site Request Forgery (CSRF)

   Cross-Site Request Forgery (CSRF) is a technique where an attacker exploits the trust between a web application and its users. To do this, the attacker tricks users into performing unintended actions on their behalf.To mitigate CSRF, Ruby on Rails generates authenticity tokens. These tokens are included in forms and AJAX requests. As a result, Ruby on Rails verifies the authenticity of a form submission or AJAX request using the token. This allows the framework to prevent unauthorized actions that could be exploited by attackers.

3. Guarding Against SQL Injection Attacks

   An SQL injection attack puts your application’s database at risk. Attackers achieve this by inserting malicious SQL statements into input fields, allowing them to manipulate and access the database. To prevent these attacks, Ruby on Rails utilizes parameterized queries. This passes the parameters provided by the user separately from the SQL statement and ensures that the user input is treated as data rather than executable code.

4. Secure Session Management & Cookie Handling

   To better secure user sessions by default, Ruby on Rails maintains the session's data within Encrypted Cookie, so no one from the client side can read session data. As additional security measures, it is easy to use Signed Cookies to store non-secret, but tamper-proof data on the client. Another way that Ruby on Rails achieves this is by enabling the httponly flag. This prevents client-side scripts from accessing the cookies, protecting them against theft through XSS attacks.

5. Password Encryptio

   Ruby on Rails also encrypts passwords using bcrypt, a widely recognized and robust encryption algorithm. To better protect user passwords, bcrypt utilizes a salting and hashing technique that makes it much more expensive and time-consuming for attackers to crack.

6. HTTP Security Headers

   Ruby on Rails provides reasonable default values ​​for response security headers that are consumed by browsers to limit possible injections and malicious use of your website. For example, disallowing iframe embed. Additionally, restrictive Content-Security-Policy headers can be conveniently configured to prevent almost all possibilities of XSS attacks.

7. Encrypted credentials

   While modern web applications contain a lot of external integrations - most of them require secret credentials, access keys, crypto keys etc. Ruby on Rails provides a built-in mechanism to manage these keys in encrypted files that is easily accessible by app during the runtime. It reduces the risk of key leaks in case of plain text transfer and storage. Also, it makes it easier to synchronize this sensitive data between all project developers.

Secure Coding Practices in Ruby on Rails

Although Ruby on Rails has a number of built-in security technologies, it’s still the responsibility of developers to understand and address additional security concerns. These may be specific to your application or beyond the scope of the default security tools provided in RoR. To protect your application, your business, and your customers, secure coding practices are needed.

I recommend following official Ruby on Rails security guidelines. At the company I work for, we combine these guidelines with our own experience to solve complex security problems more efficiently. Let’s go over some secure coding practices in more detail.

Input Validation and Sanitation

Although Ruby on Rails has built-in protections against XSS attacks and SQL injection, proper input validation at the development level is still important. You should validate and sanitize all user-provided data. This may include form inputs, query parameters, and URL components. This will protect your application from data and input manipulation.

Authentication and Authorization

As in all applications, authentication and authorization are essential for controlling access to sensitive resources within your application. Devise is a comprehensive authentication framework for Ruby on Rails that simplifies the implementation of user authentication features. With Devise, your projects can have secure password storage, password reset functionality, and account lockouts to protect against brute-force attacks.

In addition to authentication, you should pay attention to proper authorization mechanisms. For example, role-based access control (RBAC) or attribute-based access control (ABAC) ensure that users have the appropriate permissions to access specific resources and actions.

Regular Updates and Patching

Ruby on Rails is regularly being patched and updated. If your application falls behind on these updates, you may be putting your application at risk. It’s important to regularly update the framework and its dependencies to ensure security for RoR applications. This includes updating Ruby on Rails, as well as other gems and libraries used within the application.

Session Management and Cookie Security

By default, Ruby on Rails already provides session management functionality. However, you should ensure that sessions data is stored securely on the server-side instead of being stored in client-side cookies. This will reduce the risk of user data exposure and tampering.

Secure Password Handling

When storing user passwords, you must ensure the passwords are salted and hashed using bcrypt with a unique salt for each user. This makes it far more difficult for hackers to crack hashed passwords, even if the hashed password database. Even if they manage to crack one password, the unique salt makes it much harder for them to perform the task at scale.

Secure Data Handling

Personally Identifiable Information (PII), financial information, and other sensitive data must be handled with care. Encrypting the transit and storage of this information is a great first step to implement into your application. This includes using HTTPS for secure communication and Encrypt data on the database level via built-in Active Record Encryption functionality. Encryption keys should be securely managed, and access to sensitive data should be restricted to authorized personnel.

Protection Against Cross-Site Scripting

Although Ruby on Rails already protects against XSS attacks by automatically escaping user-generated content, developers still need to be on their toes. Understand the different types of XSS attacks and apply appropriate countermeasures. You should be aware of the contexts where user input is displayed and use proper sanitation techniques to prevent unintended script execution.

Security Testing

One of the best ways to test your application’s security is to employ security assessments, penetration testing, and vulnerability scanning. By identifying potential weaknesses early on, you can better safeguard your application against threat actors. Automated testing with tools such as Brakeman can be used to perform static code analysis and detect common security vulnerabilities.

Often when we modernize applications or make significant changes, these changes can introduce new vulnerabilities that bad actors can exploit. Because of this, it’s always advisable to conduct security assessments during development and after these changes are implemented.

Additionally, practicing thorough code reviews and security audits throughout the development process will identify security flaws that may have otherwise been missed by developers or automated tools.

Wrapping Up

Although Ruby on Rails has a robust framework with security-focused features, developers still need to be on their toes and leverage secure coding practices to best protect your product. This includes leveraging security-focused gems, securing APIs, and following other best approaches for deployment and maintenance. By doing so, you can better protect their applications and valuable data, improving trust with customers and shareholders.

Feel free to contact me if you have any questions or drop a comment below.