Security Gems
In my last two posts, I set up a basic contact form application (here) and went through a few steps to improving the security on it (here). I also promised to write about some gems that you can use for security, so here we are!
FIGARO
Environment variables are a great way to store private data, especially when your project is publicly hosted on Github (or another such site).
Figaro configures Rails apps to keep private information (such as Stripe credentials or email log ins) private. It provides a generator that creates a file, config/application.yml. Figaro also adds this file to your .gitignore.
You can then add your environment variables to the yml file in the following format:
GMAIL_EMAIL: [email protected]
You can now use these variables in your environment files, such as production.rb. You can call them like so:
ENV[‘GMAIL_EMAIL’]
Figaro is compatable with Heroku, so if you are deploying to Heroku, you don’t need to do anything additional. You can set your production variables on Heroku as normal.
DEVISE
Devise is a gem used for authentication for Rails applications. It provides many features and can be configured to meet almost all requirements. Devise is built on top of Warden, a Rack application, which means that it runs a separate and standalone module. It is almost always executed before the chief Rails application is invoked. Warden does the cookie handling that verifies the identity of the a logged in user. It uses a secure session string, where the primary key of a particular user is stored and disguised, to do this. It also provides a way for your app to deal with users who aren’t logged in. Depending on your sign in/sign up pages, users who are not logged in will have either restricted access or no access at all until they log in.
What Warden doesn’t handle is your Rails app. It does not provide any helper methods, controller classes, views, configuration options, or log in failure handling. This is where Devise steps in.
Devise mostly interacts with Warden using Strategies (a design pattern where an algorithm is encapsulated within a dedicated class and implements a method with a commonly shared name). The Strategies that Devise uses are for email confirmations, encrypting passwords, and HTTP Authentication. You can implement a customized Strategy to extend Devise.
For more information on the implementation of Devise, check out the github repo: https://github.com/plataformatec/devise
VULNERABILITY SCANNERS
BRAKEMAN
Brakeman Scanner is a staple of every Rails security audit that includes static code analysis. It supports many different security notifications and can be run either as a comannad line app or a Ruby library inside your project.
BUNDLER-AUDIT https://github.com/rubysec/bundler-audit
Bundler-audit is used for securing your gemfile. It checks for vulnerable gems versions in Gemfile.lock, insecure gem sources, allows for ignoring certain advisories that have been manually worked around and prints advisory information.
RACK::ATTACK
Rack::attack is a rack middleware that protects your web app from malicious clients. It allows safelisting, blacklisting, throttling, and tracking based on arbitrary properties of the request. It’s useful for a basic defense against DDoS attacks and limiting brute force options when trying to target form inputs on sign up and other critical pages.
TARANTULA
From the documentation: “Tarantula is a big fuzzy spider. It crawls your Rails 2.3 and 3.x applications, fuzzing data to see what breaks.” What it actually is, is a website crawler that tests your Rails app for input validation that results in SQL or XSS injections.
FIND MASS ASSIGNMENT https://github.com/mhartl/find_mass_assignment
Find Mass Assignment is a Rake task that finds likely mass assignment problems in Rails projects. It scans the controllers for likely mass assignment and then finds the corresponding models that don’t have attr_accessors defined.
ALPACA
With Alpaca, developers can quickly and easily configure and manage a safelist and/or blacklist. Safelisting and blacklisting can be done on the global level, controller-level via before_filter, and per-action at the controller level.
There are tons of other gems available to address varying levels and types of security concerns. Have a favorite? Let me know in the comments!