kbparagua

Security is Hard

Massive Assignment

• watch for ActiveRecord Relation, like has_many, has_many :through
• watch for user_roles, `group_users
• UPDATE action

Admin

kbparagua

Frontend Development

Attention: the list was moved to

https://github.com/dypsilon/frontend-dev-bookmarks

This page is not maintained anymore, please update your bookmarks.

---

kbparagua

Business Models

Advertising

Models	Examples
Display ads	Yahoo!
Search ads	Google

kbparagua

def authenticate email, password
  user = User.find_by_email email
  
  if password.nil? || email !=~ /\A([\w+\-].?)+@[a-z\d\-]+(\.[a-z]+)*\.[a-z]+\z/i || user.nil?
    return false
  end

  encrypted_password = BCrypt::Password.new password
  if user.encrypted_password == encrypted_password
    user

kbparagua

VALID_EMAIL_REGEX = /\A([\w+\-].?)+@[a-z\d\-]+(\.[a-z]+)*\.[a-z]+\z/i

def authenticate email, password
  user = User.find_by_email email
  
  if password.present? && valid_email?(email) && user.present? && correct_password?(user, password)
    user
  else
    false
  end

kbparagua

email !=~ /\A([\w+\-].?)+@[a-z\d\-]+(\.[a-z]+)*\.[a-z]+\z/i

kbparagua

encrypted_password = BCrypt::Password.new password
if user.encrypted_password == encrypted_password

kbparagua

VALID_EMAIL_REGEX = /\A([\w+\-].?)+@[a-z\d\-]+(\.[a-z]+)*\.[a-z]+\z/i

def valid_email? email
  email =~ VALID_EMAIL_REGEX
end

kbparagua

def correct_password? user, password
  encrypted_password = BCrypt::Password.new password
  user.encrypted_password == encrypted_password
end

kbparagua

user.correct_password? password