GuardRails at RubyNation
28 March 2011
Jonathan Burket, Patrick Mutchler, Michael Weaver, and Muzzammil Zaveri will present GuardRails: A (Nearly) Painless Solution to Insecure Web Applications at the RubyNation conference in Reston (near Washington, DC), on April 2.
With web applications continuing to grow in popularity and frameworks becoming simpler to use, creating a web application is easier than ever. While building an application may be straightforward, ensuring that it is secure requires both a deep understanding of subtle security vulnerabilities as well as tedious and careful insertion of security checks. We propose GuardRails, an open source source-to-source tool for Ruby on Rails applications that adds extra layers of security to web applications with only minimal effort from the developer. GuardRails works by attaching security policies to the data itself. These policies are automatically enforced throughout the application, without the need for the developer to write large amounts of code. Our system helps prevent against a variety of security vulnerabilities from CrossSite Scripting to faulty access controls without requiring the developer to have a sophisticated knowledge of web security.