Ruby on Rails Security Guide 2026: CSRF, Strong Params, Brakeman & CSP

class ApplicationController < ActionController::Base
  # Default for full-stack Rails — verified by origin AND token
  protect_from_forgery with: :exception

  # For API-only applications using cookie sessions
  # protect_from_forgery with: :null_session
end

<head>
  <%= csrf_meta_tags %>
</head>

skip_before_action :verify_authenticity_token # Disables CSRF — only for APIs

class UsersController < ApplicationController
  def create
    @user = User.new(user_params)
    if @user.save
      redirect_to @user
    else
      render :new, status: :unprocessable_entity
    end
  end

  private

  def user_params
    params.require(:user).permit(:name, :email, :password, :password_confirmation)
    # Never use params.require(:user).permit! — this allows ALL attributes
  end
end

def article_params
  params.require(:article).permit(
    :title, :body, :published,
    tags_attributes: [:id, :name, :_destroy]
  )
end

gem install brakeman
brakeman -q -w2 --no-pager

- name: Run Brakeman
  run: |
    gem install brakeman
    brakeman -q --exit-on-warn

# config/initializers/content_security_policy.rb
Rails.application.configure do
  config.content_security_policy do |policy|
    policy.default_src :self
    policy.font_src    :self, 'https://fonts.gstatic.com'
    policy.img_src     :self, :data, 'https:'
    policy.object_src  :none
    policy.script_src  :self
    policy.style_src   :self, 'https://fonts.googleapis.com'
    policy.connect_src :self

    # Specify URI for violation reports
    policy.report_uri '/csp-violation-report'
  end

  # Enable nonce for inline scripts (use with Rails UJS or Stimulus)
  config.content_security_policy_nonce_generator = ->(_request) {
    SecureRandom.base64(16)
  }
  config.content_security_policy_nonce_directives = %w[script-src]

  # Report-only mode for testing
  # config.content_security_policy_report_only = true
end

class InlineEditorController < ApplicationController
  content_security_policy do |p|
    p.style_src :self, :unsafe_inline
  end
end

Rails.application.configure do
  # Force HTTPS for all requests
  config.force_ssl = true

  # Session cookie configuration
  config.session_store :cookie_store,
    key:      '__Host-session',
    secure:   true,
    httponly: true,
    same_site: :lax,
    expire_after: 30.minutes
end

gem install bundler-audit
bundle-audit update  # Update vulnerability database
bundle-audit check

- name: Bundle Audit
  run: |
    gem install bundler-audit
    bundle-audit update
    bundle-audit check --ignore CVE-XXXX-XXXX # Only ignore with justification

gem install ruby_audit
ruby-audit check

name: Security Scan
on: [push, pull_request]

jobs:
  brakeman:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.3"
          bundler-cache: true
      - name: Run Brakeman
        run: bundle exec brakeman --no-pager --exit-on-warn
      - name: Audit gems for known CVEs
        run: bundle exec bundler-audit check --update
      - name: Check Ruby version for vulnerabilities
        run: gem install ruby_audit && ruby-audit check

# config/initializers/security_check.rb
if Rails.env.development?
  Rails.application.config.after_initialize do
    checks = {
      "force_ssl"        => Rails.application.config.force_ssl,
      "secure_cookies"   => Rails.application.config.session_options[:secure],
      "httponly_cookies" => Rails.application.config.session_options[:httponly],
    }
    checks.each do |name, value|
      Rails.logger.warn("Security warning: #{name} is disabled!") unless value
    end
  end
end

# test/integration/security_headers_test.rb
require "test_helper"

class SecurityHeadersTest < ActionDispatch::IntegrationTest
  test "response includes required security headers" do
    get root_path
    assert_equal "DENY", response.headers["X-Frame-Options"]
    assert_equal "nosniff", response.headers["X-Content-Type-Options"]
    assert response.headers["Content-Security-Policy"].present?,
      "Content-Security-Policy header must be set"
    assert response.headers["Strict-Transport-Security"].include?("max-age="),
      "HSTS header must include max-age"
  end
end

# config/application.rb
config.force_ssl = true  # Redirect all HTTP to HTTPS

# config/environments/production.rb
config.ssl_options = {
  hsts: {
    subdomains: true,
    preload:    true,
    expires:    1.year
  }
}

Rails.application.config.content_security_policy do |policy|
  policy.default_src :self
  policy.font_src    :self, :https, :data
  policy.img_src     :self, :https, :data
  policy.object_src  :none
  policy.script_src  :self, :https
  policy.style_src   :self, :https

  # Report violations to a collection endpoint
  policy.report_uri  "https://your-app.com/csp-violation-report"
end

# Generate a per-request nonce for inline scripts
Rails.application.config.content_security_policy_nonce_generator =
  ->(_request) { SecureRandom.base64(16) }

# Apply the nonce to script-src only
Rails.application.config.content_security_policy_nonce_directives = %w[script-src]

# Allows any parameter the user submits — including role, admin, and balance
params.require(:user).permit!

# Explicit whitelist — only these attributes can be set via form submission
params.require(:user).permit(:name, :email, :bio)

# Disables CSRF for all actions on this controller — never do this in a full-stack app
protect_from_forgery with: :null_session

# Correct approach: only skip for requests authenticated via token header
protect_from_forgery with: :exception
skip_before_action :verify_authenticity_token, if: :api_request?

private

def api_request?
  request.headers["Authorization"].present?
end

<%# Renders raw HTML — any script tag in user.bio executes in the browser %>
<%= raw user.bio %>

<%# Auto-escaped by default in ERB — safe %>
<%= user.bio %>

<%# If you need to allow some HTML, use sanitize with a strict allowlist %>
<%= sanitize user.bio, tags: %w[b i em strong p br], attributes: [] %>

# Redirects to any URL the user provides — phishing vector
redirect_to params[:return_to]

# Validate the redirect target before following it
def safe_redirect_url(url)
  uri = URI.parse(url)
  return root_path unless uri.host.nil? || uri.host == request.host
  url
rescue URI::InvalidURIError
  root_path
end

redirect_to safe_redirect_url(params[:return_to])