Guidance for implementing secure Rails applications, covering authentication, authorization, and protection against common web vulnerabilities.

Core Principles

Defense in depth — Layer multiple security controls; never rely on a single mechanism
Secure by default — Leverage Rails' built-in protections (CSRF tokens, output escaping, parameterized queries)
Least privilege — Grant minimum necessary access at every layer
Fail closed — Deny access on error; never default to permissive

Strong Parameters

Always whitelist parameters — this is the first line of defense against mass assignment:

def user_params
  params.require(:user).permit(:name, :email, :avatar)
end

# Never do this:
User.create(params[:user])  # Mass assignment vulnerability!

# Never permit sensitive attributes without authorization:
# BAD:  params.require(:user).permit(:name, :email, :admin, :role)
# GOOD: Only permit :admin or :role after verifying the current user is authorized

Guidance for implementing secure Rails applications, covering authentication, authorization, and protection against common web vulnerabilities.

Core Principles

Defense in depth — Layer multiple security controls; never rely on a single mechanism
Secure by default — Leverage Rails' built-in protections (CSRF tokens, output escaping, parameterized queries)
Least privilege — Grant minimum necessary access at every layer
Fail closed — Deny access on error; never default to permissive

Strong Parameters

Always whitelist parameters — this is the first line of defense against mass assignment:

def user_params
  params.require(:user).permit(:name, :email, :avatar)
end

# Never do this:
User.create(params[:user])  # Mass assignment vulnerability!

# Never permit sensitive attributes without authorization:
# BAD:  params.require(:user).permit(:name, :email, :admin, :role)
# GOOD: Only permit :admin or :role after verifying the current user is authorized

Vulnerability	Prevention
SQL Injection	Use parameterized queries
XSS	Don't use `raw` or `html_safe` on user input
CSRF	Keep `protect_from_forgery` enabled
Mass Assignment	Use strong parameters
Session Hijacking	Secure, httponly, same_site cookies
Broken Auth	Use Devise with secure settings
Broken Access	Implement Pundit or CanCanCan

Rails Security

Core Principles

Strong Parameters

Rails Security

Core Principles

Strong Parameters

HTTPS Enforcement

Quick Reference

Security Scanning

Pre-Deployment Checklist

Additional Resources

Reference Files

1password

Springboot Security

Security Review

Laravel Security

Security Review

Django Security