Welcome! Also in 2017 we want to find the right mix of security information, vulnerabilities in Rails’ friends and browser news. Let’s see what was interesting this week:
Several ‘exotic’ securityHTTP headers tested
Saves you some time to try out all configuration options.
Invisible Captcha: Spam protection gem
It’sbased on the honeypot strategy. Thatmeans you know it’s a spam bot if the invisible field is filled out.
Another Rails security checklist
CSRFvulnerability in rails_admin gem
Tool todetect TLS/SSLvulnerabilities and versions
This is probably only useful if you can’t use the Qualys SSL Server Test.For example in a restricted environment.
Version handling differencesbetween RubyGems and npm
If you’re using both Node and Ruby, you might find this guide interesting.
NewContent-Security-Policy (CSP) directive require-sri-forcoming to Chrome
Subresource Integrity (SRI) is amechanism by which user agents may verify that fetched scripts/styles have been delivered without manipulation. This CSP directive allows developers to require SRI for certain types of resources.
Important security updates
[ImageMagick] Criticalbuffer overflowvulnerabilitybefore version7.0.2-7.
There were also several memoryproblems in the versionsbefore.
There were also several memoryproblems in the versionsbefore.
Like this kind of articles?
Subscribe to hear about new Rails security resources first. Only helpful articles and guides. Monthly(ish) updates, no spam.
