Question 1

What mechanism does Rails use by default to protect against CSRF attacks?

Accepted Answer

Rails generates a unique CSRF token per session and automatically includes it in forms via a hidden field. This token is verified server-side for every non-GET request. The form_with helper automatically inserts this token, and protect_from_forgery is enabled by default in ApplicationController.

Question 2

How to disable CSRF protection for a specific action in an API controller?

Accepted Answer

The skip_before_action :verify_authenticity_token method disables CSRF verification for specific actions. This is common for APIs using token-based authentication (JWT, API key) rather than sessions. It's recommended to limit this exception to strictly necessary actions using the only option.

Question 3

What vulnerability is exploited in this code: User.where("name = '#{params[:name]}'")?

Accepted Answer

Direct params interpolation in a SQL query allows SQL injection. An attacker can send name="'; DROP TABLE users; --" to execute arbitrary SQL code. Use ActiveRecord placeholders instead: User.where(name: params[:name]) or User.where("name = ?", params[:name]).

Rails Security

What mechanism does Rails use by default to protect against CSRF attacks?

Câu trả lời

How to disable CSRF protection for a specific action in an API controller?

Câu trả lời

What vulnerability is exploited in this code: User.where("name = '#{params[:name]}'")?

Câu trả lời

Which ActiveRecord method automatically protects against SQL injection?

How does Rails automatically protect against XSS attacks in ERB views?

Các chủ đề phỏng vấn Ruby on Rails khác

Ruby Basics

Ruby Object-Oriented Programming

Rails Fundamentals

Routing & Controllers

ActiveRecord Basics

Views & ERB Templates

ActiveRecord Associations

Advanced ActiveRecord Queries

Rails Forms

Authentication & Authorization

Modern Asset Pipeline & Frontend

Rails API Mode

Testing with RSpec

ActiveJob & Background Jobs

ActionCable & WebSockets

ActionMailer

ActiveStorage

Caching Strategies

Advanced Migrations

Rails Engines & Modular Apps

Performance Optimization

Rails Design Patterns

Ruby Metaprogramming

GraphQL with Rails

Deployment & Production

Monitoring & Logging

Rails Upgrade Strategies

Nắm vững Ruby on Rails cho lần phỏng vấn tiếp theo