2

For a recent project a friend of mine and I have been working on, we want to build a RESTful web API for client application usage. I believe that I have a fairly good grasp of the top-down picture after reading this, but am fairly clueless when it comes to security issues.

I know of OAuth and plan on implementing it, but are there any other concerns we should address first thing? I would hate to spend a large amount of time developing these features to find out later that we've left the site open for malicious attack.

Thanks.

Community
  • 1
  • 1
Chuck Callebs
  • 16,293
  • 8
  • 56
  • 71

2 Answers2

3

If you are looking for general information on Web security, check out OWASP Ruby on Rails Security Guide V.2. (There's also a first edition which I read back in the day.) Check out OWASP's web site for more security related information.

Eric Bronnimann
  • 941
  • 7
  • 8
1

A few more resources for you:

Great walkthrough of common web attacks and how to deal with them in rails https://www.honeybadger.io/blog/guides/2013/03/09/ruby-security-tutorial-and-rails-security-guide

Rails insecure defaults http://blog.codeclimate.com/blog/2013/03/27/rails-insecure-defaults

All about sql injection, goes beyond the simple examples http://rails-sqli.org

New security issues are listed at

J_McCaffrey
  • 1,455
  • 12
  • 15