Ruby on Rails Security Project - Journal

Friday

Feb162007

Welcome

Friday, February 16, 2007 at 12:37AM

What's happening here?

It's about Ruby on Rails, it's about the technologies around RoR and it's

about its security. It might turn out to be about the fast growing role of

LARM. (Yes, I invented this term right now, it's in the style of LAMP, which

stands for the architecure of Linux + Apache + MySQL + PHP. So cross out PHP,

put in RoR, stir it well and you get: Linux + Apache + Ruby on Rails + MySQL = LARM.

Of course Apache might require some extra modules and RoR has in fact two R's,

but hey, sounds good.)

Security

Why is security so important, you might ask, when you're only programming this little

web shop for your neighbour's death-metal band? Well, it's to make life harder

for crackers or script kiddies who can do a lot of nasty things with your web site. They could deface (i.e. change parts of your web site) to harm others (e.g. get hold of

the accounts of your customers, distribute worms and so on) or simply down your web site.

Don't panic

But don't worry, with a little more understanding and security advices you can

make your web site a secure zone. And that's what we can learn here together.

I'm doing a several-months-every-day-research into security of Ruby on Rails.

And I thought the results might be not only interesting for me.

Let's do it

I think many of us share the perception of Rails being a "secure" framework.

And that might well be true, because we need less code to get things done and less

code means a better overview of what's happening.

But though Rails seems to be safer, doesn't allow us to lean back. There has

been a security bug (more detailed) in Rails last year and even in Ruby.

In fact most of the security issues with web sites or web applications don't

necessarily stem from the programming language or framework we use, but affect

web applications in general. It's the way we config our servers and it's the way

we program.

Starting point

As a good starting point, I've found a good Ruby on Rails example, which deliberately

includes several security vulnerabilities: The Hacme Casino. Especially reading the user guide gives you a good insight on what can go wrong.

Use these links to find out more on the terms used in the user guide:

SQL-Injection

Cross Site Request Forgery

Onwards

I will most likely categorize the posts according to the layer. There's the layer

of the web server, the layer of the database server and there's the RoR application

itself. I will most like start out at the bottom with the servers.

I strongly encourage you to give me feedback by comments.

Heiko |

66 Comments |

View Printer Friendly Version

Email Article to Friend

Reader Comments (66)

Awesome!

I've been trying to find RoR specific security info for a while. I was about to go and learn how to use RoR myself to find out, but now I can find out from someone who actually knows something about Rails.

I eagerly anticipate any writing you do on this topic, :)

February 25, 2007 |

kuza55

Congrats on breaching a much needed topic.

As primarily a PHP programmer, I run across a lot of poorly written code - most of the flaws are easily avoidable with basic security knowledge.

You're in my RSS reader now - looking forward to some great content!

March 4, 2007 |

Wes Ratcliff

Hi! Nice site! http://phentermine.webblogg.se/ [url = http://adipex.webblogg.se/ ] Buy Adipex [/url]

March 20, 2007 |

Buy Vicodin

May 1, 2007 |

tebojokl

May 4, 2007 |

prohinmo

Heiko,

Just found your site and I'm really looking forward to reading all you've published so far.

Thanks for concentrating on this important topic and keep up the good work!

May 5, 2007 |

Curtis Miller

May 6, 2007 |

fivzerop

May 8, 2007 |

eblakoin

May 10, 2007 |

sevoneow

May 10, 2007 |

sevoneowv

May 12, 2007 |

fortumol

May 12, 2007 |

fortumomy

May 14, 2007 |

nuiokelo

May 15, 2007 |

looneymoo

May 15, 2007 |

looneymu

May 17, 2007 |

klounmdou

May 22, 2007 |

nouwtendr

May 25, 2007 |

bolonurog

May 28, 2007 |

molerwow

May 28, 2007 |

molerwoq

Post a New Comment

Enter your information below to add a new comment.

My response is on my own website »

Author:

Author Email (optional):

Author URL (optional):

Post:

↓ | ↑

Some HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <code> <em> <i> <strike> <strong>

Welcome

Reader Comments (66)

Post a New Comment

Link an External Response