Go through the security checklist

[eugenk]

See https://github.com/brunofacca/zen-rails-security-checklist.
Some of this is only applicable to apps with html views, but some of it is very important for the API-side as well.

Update (16 Nov 2017)

I went through the checklist and these are the points which we need to pay a little bit more attention to:

Authentication

• Expire the session at log out and expire old sessions at every successful login. Mitigates CSRF, session hijacking and session fixation attacks by reducing their time-frame.

  Backend: We would need to have a column session_key for a User that is re-written on every sign-in. A sign-out would delete the session_key. This requires a signOutMutation. Authentication only happens if the correct session_key is inside the JWT.

  Frontend: Sign-out not only deletes the JWT in the browser, but also invalidates the session_key

• Expire sessions after a period of inactivity (e.g., 30 minutes). Mitigates CSRF, session hijacking and session fixation attacks by reducing their time-frame.

  Backend: We do have an expiration time in the JWT but, currently, we don't check it during authentication.

• Consider using two-factor authentication (2FA) as provided by Authy. Provides a highly effective extra layer of authentication security.
  Devise: see the devise-two-factor and authy-devise gems.

HTTP & TLS

Security-related headers

• Consider using the Secure Headers gem. Mitigates several attacks.

Security Tools

• Run Brakeman before each deploy. If using an automated code review tool like Code Climate, enable the Brakeman engine.

• Consider using a continuous security service such as Detectify.

  Detectify automatically scans the application for several hundred security vulnerabilities. It even has a free plan for nonprofit organisations (but only one domain/subdomain). They need to be contacted by mail in this case.

• Consider using a Web Application Firewall (WAF) such as
  NAXSI for Nginx,
  ModSecurity for Apache and Nginx.
  Mitigates XSS, SQL Injection, DoS, and many other attacks.