# Keamanan Rails (Ruby on Rails)

> Proteksi CSRF, SQL injection, XSS, mass assignment, manajemen secrets, HTTPS

- 22 pertanyaan wawancara
- Senior
- [Pertanyaan Wawancara: Ruby on Rails](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara.md)

## 1. Mekanisme apa yang digunakan Rails secara default untuk melindungi dari serangan CSRF?

**Jawaban**

Rails menghasilkan token CSRF unik per sesi dan menyertakannya secara otomatis ke dalam form melalui field hidden. Token ini diverifikasi di sisi server untuk setiap request non-GET. Helper form_with menyisipkan token ini secara otomatis, dan protect_from_forgery aktif secara default di ApplicationController.

## 2. Bagaimana cara menonaktifkan proteksi CSRF untuk action tertentu di controller API?

**Jawaban**

Metode skip_before_action :verify_authenticity_token menonaktifkan verifikasi CSRF untuk action tertentu. Ini umum pada API yang menggunakan autentikasi berbasis token (JWT, API key) alih-alih session. Disarankan untuk membatasi pengecualian ini hanya pada action yang benar-benar diperlukan dengan opsi only.

## 3. Kerentanan apa yang dieksploitasi dalam kode ini: User.where("name = '#{params[:name]}'")?

**Jawaban**

Interpolasi langsung params dalam query SQL memungkinkan SQL injection. Penyerang dapat mengirim name="'; DROP TABLE users; --" untuk mengeksekusi kode SQL sembarang. Gunakan placeholder ActiveRecord sebagai gantinya: User.where(name: params[:name]) atau User.where("name = ?", params[:name]).

## 19 pertanyaan lagi tersedia

- Metode ActiveRecord mana yang secara otomatis melindungi dari SQL injection?
- Bagaimana Rails secara otomatis melindungi dari serangan XSS di view ERB?

Daftar gratis: https://sharpskill.dev/id/login

## Topik wawancara Ruby on Rails lainnya

- [Dasar-Dasar Ruby](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/ruby-basics.md): 25 pertanyaan, Junior
- [Pemrograman Berorientasi Objek di Ruby](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/ruby-oop.md): 20 pertanyaan, Junior
- [Dasar-Dasar Rails](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/rails-fundamentals.md): 18 pertanyaan, Junior
- [Routing & Controllers](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/routing-controllers.md): 22 pertanyaan, Junior
- [Dasar-Dasar ActiveRecord](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/active-record-basics.md): 25 pertanyaan, Junior
- [Views & Template ERB](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/views-erb-templates.md): 20 pertanyaan, Junior
- [Asosiasi ActiveRecord](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/active-record-associations.md): 24 pertanyaan, Mid-Level
- [Kueri ActiveRecord Lanjutan](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/active-record-queries.md): 28 pertanyaan, Mid-Level
- [Formulir Rails](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/rails-forms.md): 20 pertanyaan, Mid-Level
- [Autentikasi & Otorisasi](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/authentication-authorization.md): 22 pertanyaan, Mid-Level
- [Asset Pipeline modern & frontend](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/rails-asset-pipeline.md): 18 pertanyaan, Mid-Level
- [Mode API Rails](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/rails-api-mode.md): 20 pertanyaan, Mid-Level
- [Pengujian dengan RSpec](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/rails-testing-rspec.md): 24 pertanyaan, Mid-Level
- [ActiveJob & Background Jobs](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/active-job-background-jobs.md): 20 pertanyaan, Mid-Level
- [ActionCable & WebSockets](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/action-cable-websockets.md): 18 pertanyaan, Mid-Level
- [ActionMailer](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/action-mailer.md): 18 pertanyaan, Mid-Level
- [ActiveStorage](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/active-storage.md): 20 pertanyaan, Mid-Level
- [Strategi Caching](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/caching-strategies.md): 20 pertanyaan, Mid-Level
- [Migrasi tingkat lanjut](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/database-migrations-advanced.md): 20 pertanyaan, Mid-Level
- [Rails Engines & Aplikasi Modular](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/rails-engines-modular-apps.md): 18 pertanyaan, Senior
- [Optimasi Performa](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/performance-optimization.md): 26 pertanyaan, Senior
- [Design Pattern Rails](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/rails-design-patterns.md): 22 pertanyaan, Senior
- [Metaprogramming Ruby](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/ruby-metaprogramming.md): 20 pertanyaan, Senior
- [GraphQL dengan Rails](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/graphql-rails.md): 20 pertanyaan, Senior
- [Deployment & Produksi](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/rails-deployment-production.md): 20 pertanyaan, Senior
- [Monitoring & Logging](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/monitoring-logging.md): 20 pertanyaan, Senior
- [Strategi Upgrade Rails](https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/rails-upgrade-strategies.md): 18 pertanyaan, Senior

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/id/technologies/ruby-on-rails/pertanyaan-wawancara/rails-security