Hot answers tagged rails
How can I defend against malicious GET requests? These requests do not look really malicious. At least based on your description they don't cause any harm, i.e. no unwanted code execution, SQL injection or similar attacks. They only need some resources to process. What you see is what every operator of a web server can see in the log files: lots of ...
The easiest defense solution would be to install a Web Application Firewall. You can find in-depth descriptions regarding them on OWASP and Wikipedia. I doubt the requests would slow down your site. Attackers would most likely request existing items as it would be far more effective in wasting your web-server's resources.
Yes, there's no problem with using the same CSRF token since it is already sharing the same auth token. As long as the token is regenerated per new session and both the API and the APP check that the CSRF token is associated with that particular session then this should mitigate CSRF.
This sounds different from what I've heard about previously. My understanding of a typical microservice architecture is that you'd have a variety of fine-grained microservices, composited together into one or more coarse-grained applications. In that view, you would probably have a single E-Commerce Web App, which utilizes a variety of microservices in the ...
Only top voted, non community-wiki answers of a minimum length are eligible