Rails Security Specialist

Specialized in implementing security best practices for Rails applications.

When to Use This Skill

• Implementing user authentication
• Adding authorization and access control
• Protecting against common vulnerabilities (XSS, CSRF, SQL injection)
• Securing API endpoints
• Implementing strong parameters

Core Principles

• Defense in Depth: Multiple layers of security
• Least Privilege: Grant minimum necessary permissions
• Secure by Default: Safe defaults, explicit opt-in for risky operations
• Validate Input: Never trust user input
• Protect Sensitive Data: Encrypt passwords and sensitive information

Implementation Guidelines

Strong Parameters

class UsersController < ApplicationController
    def create
        @user = User.new(user_params)
        if @user.save
            redirect_to @user
        else
            render :new
        end
    end

    private

    def user_params
        # WHY: Whitelist permitted attributes to prevent mass assignment
        params.require(:user).permit(:name, :email, :password, :password_confirmation)
    end
end

Authentication with Devise

class ApplicationController < ActionController::Base
    before_action :authenticate_user!

    # WHY: Allow public access to specific actions
    skip_before_action :authenticate_user!, only: [:index, :show]
end

Authorization

class ArticlesController < ApplicationController
    before_action :authenticate_user!
    before_action :set_article, only: [:edit, :update, :destroy]
    before_action :authorize_owner!, only: [:edit, :update, :destroy]

    private

    def set_article
        @article = Article.find(params[:id])
    end

    def authorize_owner!
        unless current_user.admin? || @article.user == current_user
            redirect_to root_path, alert: 'Not authorized'
        end
    end
end

Using Pundit for Authorization

# app/policies/article_policy.rb
class ArticlePolicy < ApplicationPolicy
    def update?
        user.admin? || record.user == user
    end

    def destroy?
        user.admin? || record.user == user
    end
end

# In controller
class ArticlesController < ApplicationController
    def update
        @article = Article.find(params[:id])
        authorize @article

        if @article.update(article_params)
            redirect_to @article
        else
            render :edit
        end
    end
end

SQL Injection Prevention

# Bad: SQL injection vulnerable
User.where("email = '#{params[:email]}'")

# Good: Parameterized query
User.where('email = ?', params[:email])

# Good: Hash conditions
User.where(email: params[:email])

# Good: Named parameters
User.where('email = :email', email: params[:email])

Cross-Site Scripting (XSS) Prevention

# In views: Rails escapes by default
<%= @user.name %>  # Automatically escaped

# Explicitly escape
<%= h @user.name %>

# Mark as HTML safe only for trusted content
<%= sanitize @article.content %>

# Raw (dangerous, avoid unless necessary)
<%= raw @trusted_html %>  # Use sparingly

CSRF Protection

class ApplicationController < ActionController::Base
    # WHY: Enabled by default, protects against CSRF attacks
    protect_from_forgery with: :exception

    # For API endpoints
    protect_from_forgery with: :null_session
end

Password Security

class User < ApplicationRecord
    # Use bcrypt for password hashing
    has_secure_password

    validates :password, length: { minimum: 8 }, on: :create
    validates :password, format: {
        with: /\A(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/,
        message: 'must include uppercase, lowercase, and number'
    }, on: :create
end

Secure Token Generation

class User < ApplicationRecord
    has_secure_token :auth_token

    # Custom token generation
    before_create :generate_reset_token

    private

    def generate_reset_token
        # WHY: Use SecureRandom for cryptographically secure tokens
        self.reset_token = SecureRandom.urlsafe_base64(32)
    end
end

API Authentication

class Api::BaseController < ActionController::API
    before_action :authenticate_api_user!

    private

    def authenticate_api_user!
        token = request.headers['Authorization']&.split(' ')&.last
        @current_user = User.find_by(auth_token: token)

        # WHY: Return 401 if token invalid
        render json: { error: 'Unauthorized' }, status: :unauthorized unless @current_user
    end
end

Rate Limiting

# Using Rack::Attack
class Application < Rails::Application
    config.middleware.use Rack::Attack
end

# config/initializers/rack_attack.rb
Rack::Attack.throttle('api/ip', limit: 100, period: 1.hour) do |req|
    req.ip if req.path.start_with?('/api')
end

Content Security Policy

# config/initializers/content_security_policy.rb
Rails.application.config.content_security_policy do |policy|
    policy.default_src :self
    policy.script_src :self, :https
    policy.style_src :self, :https
    policy.img_src :self, :https, :data
end

Common Vulnerabilities to Prevent

Mass Assignment

# Bad: Allows users to set any attribute
User.create(params[:user])

# Good: Use strong parameters
User.create(user_params)

Insecure Direct Object Reference

# Bad: Users can access any article by ID
@article = Article.find(params[:id])

# Good: Scope to current user
@article = current_user.articles.find(params[:id])

Session Fixation

# After login, reset session
def create
    user = User.authenticate(params[:email], params[:password])
    if user
        reset_session  # WHY: Prevent session fixation
        session[:user_id] = user.id
        redirect_to dashboard_path
    end
end

Tools to Use

• Read: Review existing security code
• Edit: Modify security implementations
• Bash: Run security audit tools
• mcp__serena__find_symbol: Find security patterns

Bash Commands

# Run Brakeman security scanner
gem install brakeman
brakeman

# Run Bundler audit
gem install bundler-audit
bundle audit

# Check for vulnerable gems
bundle exec bundle-audit check --update

Workflow

1. Identify Security Requirements: Authentication, authorization needs
2. Write Security Tests: Test unauthorized access
3. Implement Protection: Add authentication/authorization
4. Use Strong Parameters: Whitelist attributes
5. Test Security: Verify protection works
6. Run Security Audit: Use Brakeman
7. Review Dependencies: Check for vulnerable gems

Related Skills

• rails-model-design: Secure model validations
• rails-rspec-testing: Testing security features

Coding Standards

See Rails Coding Standards

TDD Workflow

Follow TDD Workflow

Key Reminders

• Always use strong parameters
• Parameterize SQL queries (never string interpolation)
• Enable CSRF protection
• Use has_secure_password for passwords
• Authenticate before authorization
• Validate and sanitize user input
• Use HTTPS in production
• Keep dependencies updated
• Run security audits regularly
• Implement proper error handling (don't leak sensitive info)