Data-Centric Security

http://13.rupy.eu

Transcript

1. SECURITY Data-Centric
2. Security?
3. Sanitization CSRF XSS DOS ACL Roles Rules Fields
4. ACL {1. Authentication 2. Role matching 3. Endpoint access 4. Action access 5. Field access
5. How do we typically do that? attr_accessible strong parameters
6. CanCan
7. 10s of roles 100s of models of controllers of contexts
8. Logical Rules Physical Rules
9. Controllers Nesting Context
10. Account Product Widget Sidekiq Card Model ...
11. Data-Centric Model + Concern
12. Concern Presenter CanCan strong parameters {
13. Fields Management
14. Dependencies Modules Duplication
15. Protector github.com/inossidabile/protector
16. Card Model Title Number Cardholder Admin Other read write read write read write read write read write read write
17. Card.restrict!(current_user) User’s Cards
18. Card.restrict!(current_user) all cards of the user Card.first.restrict!(current_user) first card of the user Card.restrict!(current_user).first
19. ORM SAFE { :can :cannot :scope
20. class Card < ActiveRecord::Base protect do |user| if user.admin? can :view cannot :view, :number can :create can :update, %w(title number) can :destroy end end end
21. class Card < ActiveRecord::Base protect do |user, card| if card.try(:user_id) == user.id can :view cannot :view, :number can :create can :update, %w(title number) can :destroy end end end
22. :can :cannot Validations !
23. { title: 'My Account', number: '1234567890', cards_attributes: [ { title: 'My Card', number: '4242424242424242', transactions_attributes: [ { date: '2013-01-01 20:40:00', sum: 100.4 } ] } ] }
24. :can :cannot Associations !
25. class Alice < Sequel::Model protect do |realm| if realm.wonderland? can :drink can :eat, :cake end end end
26. :can :cannot Custom Rules !
27. class Card < ActiveRecord::Base protect do |user| if user.admin? scope { all } else scope { where(hidden: false) } end end end
28. Eager Loading ! :scope
29. class CardsController def index @cards = Card.restrict!(current_user) .page(params[:page]) end def update Card.restrict!(current_user) .find(params[:id]) .update_attributes(params[:card]) end end ORM SAFE
30. ActiveRecord Sequel Mongoid
31. Protector:: CanCan InheritedResources SimpleForm StrongParameters
32. Protector Meta =
33. serving point serialization template CRUD logic Jbuilder Routes Protector
34. Protector The future
35. ActiveRecord Sequel Mongoid Data Mapper (ROM)
36. Data Throttling Sanitization ACL
37. PAAS Platform Jbuilder Protector Slash Admin
38. Questions! http://stackoverflow.com #protector irc.freenode.net #protector.rb