# Rails Security (Ruby on Rails)

> CSRF protection, SQL injection, XSS, mass assignment, secrets management, HTTPS

- 22 interview questions
- Senior
- [Interview Questions: Ruby on Rails](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions.md)

## 1. What mechanism does Rails use by default to protect against CSRF attacks?

**Answer**

Rails generates a unique CSRF token per session and automatically includes it in forms via a hidden field. This token is verified server-side for every non-GET request. The form_with helper automatically inserts this token, and protect_from_forgery is enabled by default in ApplicationController.

## 2. How to disable CSRF protection for a specific action in an API controller?

**Answer**

The skip_before_action :verify_authenticity_token method disables CSRF verification for specific actions. This is common for APIs using token-based authentication (JWT, API key) rather than sessions. It's recommended to limit this exception to strictly necessary actions using the only option.

## 3. What vulnerability is exploited in this code: User.where("name = '#{params[:name]}'")?

**Answer**

Direct params interpolation in a SQL query allows SQL injection. An attacker can send name="'; DROP TABLE users; --" to execute arbitrary SQL code. Use ActiveRecord placeholders instead: User.where(name: params[:name]) or User.where("name = ?", params[:name]).

## 19 more questions available

- Which ActiveRecord method automatically protects against SQL injection?
- How does Rails automatically protect against XSS attacks in ERB views?

Sign up for free: https://sharpskill.dev/en/login

## Other Ruby on Rails interview topics

- [Ruby Basics](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/ruby-basics.md): 25 questions, Junior
- [Ruby Object-Oriented Programming](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/ruby-oop.md): 20 questions, Junior
- [Rails Fundamentals](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/rails-fundamentals.md): 18 questions, Junior
- [Routing & Controllers](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/routing-controllers.md): 22 questions, Junior
- [ActiveRecord Basics](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/active-record-basics.md): 25 questions, Junior
- [Views & ERB Templates](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/views-erb-templates.md): 20 questions, Junior
- [ActiveRecord Associations](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/active-record-associations.md): 24 questions, Mid-Level
- [Advanced ActiveRecord Queries](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/active-record-queries.md): 28 questions, Mid-Level
- [Rails Forms](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/rails-forms.md): 20 questions, Mid-Level
- [Authentication & Authorization](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/authentication-authorization.md): 22 questions, Mid-Level
- [Modern Asset Pipeline & Frontend](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/rails-asset-pipeline.md): 18 questions, Mid-Level
- [Rails API Mode](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/rails-api-mode.md): 20 questions, Mid-Level
- [Testing with RSpec](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/rails-testing-rspec.md): 24 questions, Mid-Level
- [ActiveJob & Background Jobs](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/active-job-background-jobs.md): 20 questions, Mid-Level
- [ActionCable & WebSockets](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/action-cable-websockets.md): 18 questions, Mid-Level
- [ActionMailer](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/action-mailer.md): 18 questions, Mid-Level
- [ActiveStorage](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/active-storage.md): 20 questions, Mid-Level
- [Caching Strategies](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/caching-strategies.md): 20 questions, Mid-Level
- [Advanced Migrations](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/database-migrations-advanced.md): 20 questions, Mid-Level
- [Rails Engines & Modular Apps](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/rails-engines-modular-apps.md): 18 questions, Senior
- [Performance Optimization](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/performance-optimization.md): 26 questions, Senior
- [Rails Design Patterns](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/rails-design-patterns.md): 22 questions, Senior
- [Ruby Metaprogramming](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/ruby-metaprogramming.md): 20 questions, Senior
- [GraphQL with Rails](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/graphql-rails.md): 20 questions, Senior
- [Deployment & Production](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/rails-deployment-production.md): 20 questions, Senior
- [Monitoring & Logging](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/monitoring-logging.md): 20 questions, Senior
- [Rails Upgrade Strategies](https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/rails-upgrade-strategies.md): 18 questions, Senior

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/en/technologies/ruby-on-rails/interview-questions/rails-security