Skip to content

Instantly share code, notes, and snippets.

@vishnugopal

vishnugopal/rails-security.md

Created September 17, 2012 18:46
Show Gist options
  • Save vishnugopal/3739019 to your computer and use it in GitHub Desktop.
Save vishnugopal/3739019 to your computer and use it in GitHub Desktop.
Download ZIP
Rails Security Best Practices
Raw
rails-security.md

Security Best Practices

  • Force SSL for Rails
  • Switch to encrypted_cookie_store
  • Set session expire_after to 10 minutes
  • Make sure that protect_from_forgery is set.
  • Make sure passenger & nginx runs as nobody or a less privileged user.
  • Double check uploads to make sure it is handling relative paths
  • Use attr_accessible where it makes sense
  • Filter all sensitive info from from logs
  • Audit regular expressions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment