How to Build A Secure Website With Ruby On Rails

application.rb

config.force_ssl = true

csrf.js

var form_data = //.. Serialise a form

// Get token and param from the meta tags
var token = $('meta[name="csrf-token"]').attr('content');
var param = $('meta[name="csrf-param"]').attr('content');

// Create url of "/settings/profile?name=Jeremy+Walker&authenticity_token=askdsalewg303y09sd00dshb0b00ac0dffbafds"
document.location = "/settings/profile?_method=PUT&" + form_data + "&" + token + "=" + param;

database_session_script.bash

rails generate session_migration
rake db:migrate

heroku_setup.bash

heroku addons:add ssl:endpoint
heroku certs:add my_cerficate.crt site.key

session_store.rb

Security::Application.config.session_store :active_record_store

sessions_controller.rb

# Authenticate user
@user = #...

# Destroy the existing session in case anyone is sharing it and
# create a new session that you know to be unique to the user.
reset_session

# Store the user's id as normal
session[:user_id] = @user.id

settings_controller.rb

class SettingsController < ApplicationController

  def show
    @user = User.find(session[:user_id])
  end

  def update
    @user = User.find(session[:user_id])
    @user.update_attributes(params[:settings])
  end

end

settings_routes.rb

Security::Application.routes.draw do
  match 'show_settings' => "settings#show"
  match 'update_settings' => "settings#update"
end

settings_routes_2.rb

Security::Application.routes.draw do
  get 'show_settings' => "settings#show"
  put 'update_settings' => "settings#update"
end

settings_routes_3.rb

Security::Application.routes.draw do
  resource :settings
end