Summary

In this chapter, you learned about many ways to implement security in your web application.

You learned that most of the vulnerabilities in Ruby web applications are high-level vulnerabilities, not low-level vulnerabilities. You learned that you should never trust user input and that you should use a whitelist approach instead of a blacklist approach when handling user input. You also learned how to implement access control at the highest level possible and use a fail-closed design to avoid security issues. Then, you learned techniques for avoiding script injections, SQL injections, and code injections. Finally, you learned about high-security environments and defense-in-depth techniques that make system compromise more difficult and mitigate possible damage in case it occurs.

With the knowledge you've gained in this chapter, you can design secure Ruby web applications.