https://www.toidang.xyz/tags/security/ Recent content in Security on ToiDB https://www.toidang.xyz/web/static/me-512x512.png https://www.toidang.xyz/web/static/me-512x512.png Hugo en Wed, 12 Jun 2024 10:55:39 +0700 https://www.toidang.xyz/posts/2024/03/26/what-are-hsts-and-the-hsts-preload-list/ Tue, 26 Mar 2024 10:08:55 +0700 https://www.toidang.xyz/posts/2024/03/26/what-are-hsts-and-the-hsts-preload-list/ The HSTS (HTTP Strict Transport Security) protocol is a policy / mechanism that forces a web connection over a secure HTTPS channel. In other words: without a valid SSL certificate, such a website will not load in your browser. The browser will not even show the option to ignore the SSL warning. https://www.toidang.xyz/posts/2020/01/07/understanding-csrf-in-ruby-on-rails/ Tue, 07 Jan 2020 21:08:55 +0700 https://www.toidang.xyz/posts/2020/01/07/understanding-csrf-in-ruby-on-rails/ CSRF (Cross-Site Request Forgery) is a type of attack where an attacker tricks a user into performing unintended actions on a web application in which the user is authenticated. In Rails, CSRF protection is implemented to prevent such attacks. This article explains what CSRF is, how it works in Rails, and the mechanisms used to prevent CSRF attacks. https://www.toidang.xyz/posts/2016/10/03/prevent-content-type-spoofing-on-paperclip/ Mon, 03 Oct 2016 18:08:55 +0700 https://www.toidang.xyz/posts/2016/10/03/prevent-content-type-spoofing-on-paperclip/ If you have ever used paperclip, maybe you have seen the message like that: Image has contents that are not what they are reported to be. For this bug, we will have two solutions: specify an extension that cannot otherwise be mapped or override media_type_spoof_detector method.