guest@websec ~ % cat README
Web Security Field Guide
Security training for our Rails team. Each topic explains the idea in plain terms, then tells you straight: does Rails handle this, or do we? Two quizzes at the end.
How to use this guide
- One topic per page. One or two a week works well for a team session. Go in order: later lessons build on earlier ones.
- Hit ▶ play on the animations to watch an attack step by step. Green boxes are little simulations you can poke at.
- Code samples default to Rails. The
code:switch in the title bar shows Node or Python versions where they exist. - Coloured boxes show Rails' status on each topic:
Rails handles this out of the box. Know what not to undo.
Rails gives you the tools, but you must enable, configure or finish the job.
Rails does nothing here. It's entirely our code and process.
part 1 · start here: injection
part 2 · accounts and access control
part 3 · files, browsers and headers
part 4 · server side and secrets
part 5 · operations and design
part 6 · questionnaires
OWASP Top 10:2025 at a glance
The OWASP Top 10 is the industry's list of the biggest web risks. Here's where each one lives in this guide, and how much Rails helps:
| # | risk | Rails | pages |
|---|---|---|---|
| A01 | Broken Access Control incl. IDOR, BFLA, CSRF, SSRF | partial CSRF tokens and open-redirect protection on by default; authorization and object scoping are ours | 07 08 09 13 18 |
| A02 | Security Misconfiguration debug modes, dashboards, defaults, headers | partial good production defaults; mounted dashboards, hosts, CSP are ours | 11 12 19 |
| A03 | Software Supply Chain Failures vulnerable gems, CDNs, CI | your job Brakeman in CI for new apps; patching gems and pinning scripts is ours | 12 17 |
| A04 | Cryptographic Failures TLS, storage, keys, randomness | partial force_ssl, encrypted cookies, has_secure_password; field encryption is opt-in | 05 12 15 16 |
| A05 | Injection SQL, XSS, command, header | partial ERB escaping and AR parameterization by default; raw/html_safe/interpolation are ours | 02 03 04 |
| A06 | Insecure Design business logic, races, threat modeling | your job nothing built in | 20 |
| A07 | Authentication Failures passwords, sessions, MFA, brute force | partial auth generator, rate_limit, secure sessions; MFA and lockout are ours | 05 06 08 |
| A08 | Software or Data Integrity Failures deserialization, SRI, unsigned data | partial JSON cookies and safe YAML by default; Marshal and CDN scripts are ours | 12 14 |
| A09 | Security Logging & Alerting Failures what to log, alerts, response | partial request logs with filtered params; security events and alerts are ours | 08 21 |
| A10 | Mishandling of Exceptional Conditions fail-open, errors, limits | partial generic error pages, transactions roll back; fail-closed logic is ours | 19 |
The threat model in one picture
Almost every attack in this guide targets one of these trust boundaries. Hover or tap a layer.
Browser → Network → Server → Database. Pick a layer.