The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
2answers
124 views

What can I do to increase security of a small open source application

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
1
vote
1answer
225 views

Checking if current user exists before executing code

In one of my controllers I have this method: def method_name if current_user @model = Model.find(params[:id]) if @model.destroy flash.alert = 'Model deleted successfully' ...
4
votes
2answers
293 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
1
vote
2answers
952 views

Possible attack on website

I am a developer and I therefor I have very little knowledge on security. So I need some help understanding the attack on website which we launched recently for one of our client. Website is built on ...
0
votes
1answer
116 views

Preventing body onload xss that is injected as a request parameter

I have a rails 4.0.1 app that allows locale as a request parameter. Here is what i saw when i tested my app on firefox; ...
1
vote
1answer
219 views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
5
votes
3answers
331 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
1
vote
2answers
885 views

How to test my website for the rails YAML vulnerability

I am quite puzzled by how to test my rails app for the YAML vulnerability first, I upgraded to the latest rails 3.2.11, and I tried this It gave me not likely to be vulnerable or URIPATH must be set ...
0
votes
1answer
141 views

How do I prevent my Rails application from attack? [closed]

My website is being nuked by new signups and new posts some of which don't even have user.id associated with. How do I solve this? What code should I add to the user#new page and/or post#new page. ...
1
vote
2answers
172 views

Do these mysql and ssh issues mean my rails server was hacked?

I'm running a rails application on an ubuntu server on slicehost. I got a pingdom alert that the server was unreachable, so I tried to load the website in my browser. It showed a Passenger error, ...
3
votes
2answers
1k views

Is my current method of handling session cookies insecure?

I'm writing a multi-tenant application where accounts are scoped by subdomains. This adds considerable complexity and I'm starting to worry about security. Each user can have several accounts. For ...
17
votes
3answers
1k views

Rails - protection against code injection and XSS

I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS? I know Rails tries to prevent ...
3
votes
1answer
157 views

Security of rails user access/permissions plugins

I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?