Ruby on Rails applications Security Checklist

Summary

This document provides a list of security measures to be implemented when developing a Ruby on Rails application. It is designed to serve as a quick reference and minimize vulnerabilities caused by developer forgetfulness.

Zen Rails Security Checklist

• Summary
• Supported Rails Versions
• The Checklist
  • Injection
  • Authentication (Devise)
  • Sessions & Cookies
  • Cross-Site Scripting (XSS)
    • Handling User Input
  • HTTP & TLS
  • Authorization (Pundit)
  • Files
    • File Uploads
  • Cross-Site Request Forgery (CSRF)
  • Sensitive Data Exposure
  • Routing, Template Selection, and Redirection
  • Third-party Software
  • Security Tools
  • Others
• Details and Code Samples
  • Password validation regex
  • Pundit: ensure all actions are authorized
  • Pundit: only display appropriate records in select boxes
  • Convert filter_parameters into a whitelist
• Authors
• Contributing
• References and Further Reading
• License

Read Full Document. https://github.com/brunofacca/zen-rails-security-checklist