Best way to further secure rails app from?

Question

I am using rails 3.2 and devise 1.5.3.

I added an admin attribute in my model as described in option 2 on the devise wiki How To: Add an Admin Role

I added this in a post controller for force logins:

before_filter :authenticate_user!

I wrote some logic to hide the edit/new links in my views based on whether you're an admin or not.

I feel like there's more I should be doing.. Should I add anything else to new/edit/delete actions to make them more secure? If so, where?

Answer 1

your answer may be working but it is pretty difficult to ensure security in the whole app if you are using some logic to hide the edit/new links in my views and I'm pretty sure no amount of security testing would give you the feeling that maybe you are forgetting about something

for example I someone could log in,,,, (not having admin profile) and go to (in the URL),: /users/edit/3 and start damaging your valuable information....

situation is: Devise only provides authentication,,, but authorization has to be enforced in some other way or else I could be able to do the above things...

for that I would highly recommend CanCan (from rbates ofcourse) which is the one I have tested personally and is PRETTY easy to configure just by reading the docs and examples in github..... hope it helps!

Answer 2

Your authentication and authorization mechanism is in charge of taking care of security for you, and you should make sure it's regularly updated with security updates.

That sinking feeling that you have about missing something can only reliably be covered by tests. So, write some tests that verify that the way you've setup your Devise installation is, in fact, correct, and they non-admin users do not have access to anything they shouldn't have access to. Then be very careful to make sure you update your security restrictions as you add new things.

You don't need to write tests to make sure Devise works - but you do need to write tests to make sure that your use of it is what you think it is (i.e. if non-admins shouldn't be able to get to the admin page, write a test that logs in as a non-admin, try to access that page, and verify in the test that the user is redirected and, if you have an 'access denied' message, that's it's firing). That way, if you inadvertently break security access later, you at least stand a chance that it'll be caught by a test in your test suite.

Run your test suite before every deploy, making sure that all tests (especially security tests) are running and passing. Then be vigilant thereafter, and that's about all you can do.