rails-security

Rails authentication typically uses bcrypt for password hashing and session management, while authorization patterns like Pundit enforce access control policies at the controller and model levels. This Skill covers both token-based and session-based flows, with Pundit policies defining what each user role can access.

XSS protection combines strong parameter validation, HTML escaping in views, and content security policies. CSRF protection in Rails uses authenticity tokens on forms and validates them server-side. This Skill implements both defenses across controllers, models, and views.

API security requires token-based authentication (JWT or similar), rate limiting, strong parameter validation, and proper error handling that doesn't leak sensitive data. This Skill covers token handling, API-specific authorization checks, and rate-limiting strategies.

Strong parameters validate and whitelist incoming request data, preventing malicious payloads from reaching your database. Combined with Rails' built-in parameterized query support, they block SQL injection. This Skill demonstrates strong parameter patterns across controllers.

Pundit is a lightweight authorization library that works with Rails' standard patterns to define and enforce role-based policies without heavy dependencies. This Skill uses Pundit for policy-based authorization across your application.

Authentication verifies who a user is (login credentials, tokens), while authorization determines what they can access (permissions, policies). This Skill implements layered approaches for both: secure credential handling for authentication and Pundit policies for authorization.