Question 1

What mechanism does Rails use by default to protect against CSRF attacks?

Accepted Answer

Rails generates a unique CSRF token per session and automatically includes it in forms via a hidden field. This token is verified server-side for every non-GET request. The form_with helper automatically inserts this token, and protect_from_forgery is enabled by default in ApplicationController.

Question 2

How to disable CSRF protection for a specific action in an API controller?

Accepted Answer

The skip_before_action :verify_authenticity_token method disables CSRF verification for specific actions. This is common for APIs using token-based authentication (JWT, API key) rather than sessions. It's recommended to limit this exception to strictly necessary actions using the only option.

Question 3

What vulnerability is exploited in this code: User.where("name = '#{params[:name]}'")?

Accepted Answer

Direct params interpolation in a SQL query allows SQL injection. An attacker can send name="'; DROP TABLE users; --" to execute arbitrary SQL code. Use ActiveRecord placeholders instead: User.where(name: params[:name]) or User.where("name = ?", params[:name]).

Rails Security

What mechanism does Rails use by default to protect against CSRF attacks?

Odpowiedź

How to disable CSRF protection for a specific action in an API controller?

Odpowiedź

What vulnerability is exploited in this code: User.where("name = '#{params[:name]}'")?

Odpowiedź

Which ActiveRecord method automatically protects against SQL injection?

How does Rails automatically protect against XSS attacks in ERB views?

Inne tematy rekrutacyjne Ruby on Rails

Ruby Basics

Ruby Object-Oriented Programming

Rails Fundamentals

Routing & Controllers

ActiveRecord Basics

Views & ERB Templates

ActiveRecord Associations

Advanced ActiveRecord Queries

Rails Forms

Authentication & Authorization

Modern Asset Pipeline & Frontend

Rails API Mode

Testing with RSpec

ActiveJob & Background Jobs

ActionCable & WebSockets

ActionMailer

ActiveStorage

Caching Strategies

Advanced Migrations

Rails Engines & Modular Apps

Performance Optimization

Rails Design Patterns

Ruby Metaprogramming

GraphQL with Rails

Deployment & Production

Monitoring & Logging

Rails Upgrade Strategies

Opanuj Ruby on Rails na następną rozmowę