secure_headers

Just to illustrate a potential scenario: You use a piece of open source software that has a javascript file which the author has hosted on a CDN. In order to mitigate an attack where someone changes the content of the javascript file you use a hash[1] to ensure the file does not change. You think you are safe, but a malicious actor gets access to the CDN and instead of changing the file, instead builds a quick scripts that looks for password reset referrer patterns and races the human to reset the password first. A computer is probably going to win that game that majority of the time. [1] https://github.com/twitter/secureheaders#hash

This is the counterpart for Ruby: https://github.com/twitter/secureheaders

Some ideas for a general strategy: * Check TLS/SSL https://www.ssllabs.com/ssltest/ * Use Https, HSTS * Have a security response page if someone found a problem * What to do if your application was compromised, be prepared for the worst * Check and update your software regularly * Review changes in your software regularly if it impacts your overall security strategy * Keep a security checklist in your codebase * Do your own code audits, just read it again after a few days and ask the right questions * Remove all credentials from your codebase * Read about the "new" security headers here: https://github.com/twitter/secureheaders * Know what kind of/how many requests your API/web app gets, maybe throttle or block some

Working with Clojure, I used to be jealous that the eco-system around Ruby had gems as good as this: https://github.com/twitter/secureheaders Just reading the README is a bit of an education about Content Security Policy (CSP). But over the last 2 years I've been impressed by how much the eco-system around Clojure has been catching up, and the new Ring Defaults is an example of that. These automatic security features are the kinds of things that drive people toward monolithic frameworks (so they can get these benefits without having to think about it) but I'm increasingly able to get these things (almost) automatically in the world of Clojure, while still keeping to the Clojure convention of using small, composable libraries, rather than monolithic apps (and for the micro-services I build, monolithic apps are not an option). :anti-forgery

For Rails folks, you can accomplish a lot of this with the excellent Twitter gem "secureheaders". https://github.com/twitter/secureheaders