--- title: "#345: The Zen Rails Security Checklist for Rails Apps" publication: "Ruby Weekly" issue: 345 published_at: "2017-04-20" canonical_url: "https://rubyweekly.com/issues/345" --- #345: The Zen Rails Security Checklist for Rails Apps This week's Ruby and Rails news[Read this e-mail on the Web](http://rubyweekly.com/issues/345) Ruby WeeklyIssue 345 — April 20, 2017 John Nunemaker[Resilience in Ruby: Handling Failure](https://johnnunemaker.com/resilience-in-ruby/)Using response objects to properly handle exceptions and program flow with an example of how it’s done at Github. Bruno Facca[The Zen Rails Security Checklist for Rails Apps](https://github.com/brunofacca/zen-rails-security-checklist)A quick reference primarily to minimize vulnerabilities in Rails 4 and 5 apps caused by developer forgetfulness. Clément Joubert[Improving Ruby's Memory Usage and Performance with jemalloc](https://www.levups.com/en/blog/2017/optimize_ruby_memory_usage_jemalloc_heroku_scalingo.html)We’re putting a big ‘tread carefully’ sticker on this one, but if you’re running heavy apps and running into memory issues, this may be worth exploring. BugsnagSponsored[Try Bugsnag, and Get a Free, Ultrasoft T-Shirt 👕](https://www.bugsnag.com/tshirt-promo/?utm_source=cooperpress&utm_medium=cpc&utm_content=shirt-offer&utm_campaign=2017-tsc&utm_term=ruby-weekly-20170420)Automatically capture errors in your Ruby apps, including a full stacktrace and diagnostic data to help you painlessly reproduce and fix bugs for your users. For a limited time, get a free silky soft t-shirt when you sign up and try Bugsnag. [Learn more](https://www.bugsnag.com/tshirt-promo/?utm_source=cooperpress&utm_medium=cpc&utm_content=shirt-offer&utm_campaign=2017-tsc&utm_term=ruby-weekly-20170420). [![Bugsnag\](https://copm.s3.amazonaws.com/5874f8f5.jpg)](https://www.bugsnag.com/tshirt-promo/?utm_source=cooperpress&utm_medium=cpc&utm_content=shirt-offer&utm_campaign=2017-tsc&utm_term=ruby-weekly-20170420) Amazon[How to Implement Sessions in an Alexa Skill in Ruby](https://developer.amazon.com/blogs/alexa/post/316cca44-d518-43e4-960e-1e6870a3b85a/makers-academy-s-alexa-series-how-to-implement-sessions-in-an-alexa-skill-in-ruby)Want to speak to a Ruby app via Amazon’s Echo/Alexa? There’s an [entire series](https://developer.amazon.com/blogs/alexa/post/105df30e-9890-4a8c-9caf-5de1c8ff86cb/makers-academy-s-alexa-series-how-to-build-a-hello-world-skill-with-ruby) walking through building a Ruby Alexa skill step by step. Scott Hanselman[Building Rails Apps for Azure in Ubuntu on Windows 10](https://www.hanselman.com/blog/RubyOnRailsOnAzureAppServiceWebSitesWithLinuxAndUbuntuOnWindows10.aspx)An increasingly compelling stack. _“Rails development is great on Windows 10 because you’ve got Windows 10 handling the ‘windows’ UI part and bash and Ubuntu handling the shell.”_ Stefan Wintermeyer[A Free (for Now) Kindle Book: Learn Rails 5.1, Part I](https://www.amazon.com/Learn-Rails-5-1-Part-1-ebook/dp/B06ZY5C3L8)Stefan offered to make the first part of his new Kindle book free _for a couple of days_ so grab it while you can. Jobs - [Ruby on Rails Developer at X-Team (Remote)](https://x-team.com/ruby-on-rails-developer/?utm_source=newsletter&utm_medium=email&utm_campaign=ruby-news-april-17)We seek a developer with extensive Ruby knowledge. We're 100% remote and provide the funding needed to help you achieve your goals and grow. X-Team In brief - [What Ruby Together Did and Spent in March 2017](https://rubytogether.org/news/2017-04-18-march-2017-monthly-update?utm_source=rubyweekly&utm_medium=email) news If you're wondering what [Ruby Together](https://rubytogether.org/) does with its support, here you go (Spoiler: Lots of good stuff.) Ruby Together - [How to Use Domain Model Events to Put Rails on a Diet](https://www.rubytapas.com/2017/04/11/skinny-controller-domain-model-events/?utm_source=rubyweekly&utm_medium=email) tutorial video Handle domain lifecycle events with the Observer Pattern to keep models and controllers skinny. Avdi Grimm - [An Alternate Approach Method of Slimming Down Rails](https://ecommerceonrails.com/2017/04/13/an-alternate-approach-to-avdis-method-of-slimming-down-rails-controllers/?utm_source=rubyweekly&utm_medium=email) tutorial This approach stays much closer to “The Rails Way” by introducing nested controllers. Kyle Weist - [Pry-like Runtime Invocation for IRB](http://blog.bigbinary.com/2017/04/18/binding-irb.html?utm_source=rubyweekly&utm_medium=email) tutorial Ruby 2.4 adds the ability to open an irb session at runtime with `binding.irb` Rohit Arolkar - [Add Slack Notifications to an App with Slack-Notifier and Sidekiq](http://sfviapgh.com/blog/2017/4/2/how-to-add-a-slack-notifier-with-slack-notifier-and-sidekiq?utm_source=rubyweekly&utm_medium=email) tutorial Brittany Martin - [Fixing XXE Vulnerabilities in Nokogiri](https://snyk.io/blog/nokogiri-xxe-vulnerabilities?utm_source=rubyweekly) tutorial The popular Nokogiri gem contains a pair of high-severity XXE vulnerabilities. Learn how the exploits work, and how to protect against them. SnykSponsored - [Using Chef and Capistrano to Deploy a Rails App on Ubuntu 16.04](https://medium.com/@kirill_shevch/using-chef-and-capistrano-to-deploy-rails-application-on-ubuntu-16-04-fae1dfe0dd12?utm_source=rubyweekly&utm_medium=email) tutorial Kirill Shevchenko - [Recover From Rails Database Schema Conflicts When Rebasing](https://dgmstuart.github.io/blog/2017/04/12/how-to-recover-from-rails-database-schema-conflicts-when-rebasing/?utm_source=rubyweekly&utm_medium=email) tutorial Duncan G M Stuart - [Using dry-validation as a Schema Validation Layer for Rails API](http://mensfeld.pl/2017/03/dry-validation-as-a-schema-validation-layer-for-ruby-on-rails-api/?utm_source=rubyweekly&utm_medium=email) tutorial Protect your API from incomplete and invalid requests. Maciej Mensfeld - [2 Tips for Keeping Your Rails Logs Free of Unwanted Noise](http://marianposaceanu.com/articles/keep-your-rails-logs-free-of-unwanted-noise?utm_source=rubyweekly&utm_medium=email) tutorial Marian Posaceanu - [Implementing JWT-Based Auth on a Rails RESTful JSON API](https://scotch.io/tutorials/build-a-restful-json-api-with-rails-5-part-two?utm_source=rubyweekly&utm_medium=email) tutorial Austin Kabiru - [Another Silly Coding Error With case/when](https://thomasleecopeland.com/2017/03/30/another-silly-coding-error.html?utm_source=rubyweekly&utm_medium=email) story Tom Copeland - [How to Use Vue.js and Turbolinks Together](https://gorails.com/episodes/how-to-use-vuejs-and-turbolinks-together?utm_source=rubyweekly&utm_medium=email) video GoRails - [OpsCare: an out-source DevOps solution that just works!](https://reinteractive.com/enquiries/new?code=ops_care&sid=121) tools We’ve solved the problems with ROR DevOps. Start enjoying 24/7, trouble free OpsCare® by reinteractive. ReinteractiveSponsored - [OpeningAct: Speed Up Your Sinatra Development with Templates](https://medium.com/@SunnyB/speed-up-your-sinatra-development-with-openingact-272d33bf4b7e?utm_source=rubyweekly&utm_medium=email) tools Sun-Li Beatteay - [Byebug: A Feature Rich Debugger for Ruby 2 That Uses TracePoint](https://github.com/deivid-rodriguez/byebug?utm_source=rubyweekly&utm_medium=email) tools David Rodríguez - [Try Codeship Basic: simple hosted CI that works out of the box](https://codeship.com/features/basic?utm_source=email-sponsorship&utm_medium=cpc-ruby-weekly-brief-secondary&utm_campaign=cooper-basic-features-signup-campaign) tools CodeshipSponsored - [NullDB: An ActiveRecord 'Null Database' Adapter](https://github.com/nulldb/nulldb?utm_source=rubyweekly&utm_medium=email) code Essentially ‘no-ops’ any database actions for extra speed and isolation in unit tests. Bram de Vries - [etcdv3-ruby: An In-Development Ruby Client for etcd Version 3](https://github.com/davissp14/etcdv3-ruby?utm_source=rubyweekly&utm_medium=email) code Shaun Davis Curated by [Peter Cooper](https://twitter.com/peterc) and [Glenn Goodrich](https://twitter.com/ruprict), and published by [Cooperpress](https://cooperpress.com/). Send feedback by simply replying to this mail. Want to sponsor an issue? See our [media kit.](https://cooperpress.com/mediakit) Want to post a job? Email us or [use our self-serve system.](https://booking.cooperpress.com/jobs) [Unsubscribe](*|UNSUB|*) | [Change email address](*|UPDATE_PROFILE|*) | [Read this issue on the Web](http://rubyweekly.com/issues/345) © Cooperpress Ltd. Office 30, Lincoln Way, Louth, LN11 0LS, UK [Email policy](https://cooperpress.com/spam.html) [Privacy policy](https://cooperpress.com/privacy.html)