# Sessions

**URL:** <https://www.ruby-forum.com/t/sessions/178784>\
**Category:** Rails\
**Created:** [November 11, 2009, 10:17am UTC](https://www.ruby-forum.com/t/sessions/178784 "2009-11-11T10:17:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![daveelman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bcef8e/32.png) [@daveelman](https://www.ruby-forum.com/u/daveelman)\
**Post date:** [November 11, 2009, 10:17am UTC](https://www.ruby-forum.com/t/sessions/178784/1 "2009-11-11T10:17:15Z")

</div>

I’m an experienced programmer, but new to Rails.

I would like to echo an unanswered question I’ve recently read  
elsewhere.

Can any recommend an overview of get/post, cookies, sessions, etc.,  
and how Ruby on Rails interacts with all of this?

I’m interested in understanding how to harden a Rails application

## Regards

Dave

---

<div class="post-metadata">

**Author:** ![daveelman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bcef8e/32.png) [@daveelman](https://www.ruby-forum.com/u/daveelman)\
**Post date:** [November 11, 2009, 12:31pm UTC](https://www.ruby-forum.com/t/sessions/178784/2 "2009-11-11T12:31:53Z")

</div>

Read “Agile Development with Rails” by the God of Rails, David  
Heinemeier  
Hansson. Or anything he has written. Doesn’t get any better.

2009/11/11 Dave E. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![daveelman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bcef8e/32.png) [@daveelman](https://www.ruby-forum.com/u/daveelman)\
**Post date:** [November 11, 2009, 4:38pm UTC](https://www.ruby-forum.com/t/sessions/178784/3 "2009-11-11T16:38:56Z")

</div>

On Wed, Nov 11, 2009 at 1:00 AM, Dave E. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Can any recommend an overview of get/post, cookies, sessions, etc.,  
> and how Ruby on Rails interacts with all of this?

I would start by reading the HTTP RFC(s).

–  
Hassan S. ------------------------ removed\_email\_address@domain.invalid  
twitter: @hassan

---

<div class="post-metadata">

**Author:** ![daveelman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bcef8e/32.png) [@daveelman](https://www.ruby-forum.com/u/daveelman)\
**Post date:** [November 11, 2009, 8:10pm UTC](https://www.ruby-forum.com/t/sessions/178784/4 "2009-11-11T20:10:33Z")

</div>

Dave E. wrote:

> I’m an experienced programmer, but new to Rails.
> 
> I would like to echo an unanswered question I’ve recently read  
> elsewhere.
> 
> Can any recommend an overview of get/post, cookies, sessions, etc.,  
> and how Ruby on Rails interacts with all of this?
> 
> I’m interested in understanding how to harden a Rails application

Do you need to? The framework already plugs a lot of common loopholes  
(provided the app doesn’t do stupid things). See if Rails is already  
doing what you need.

Also check out [http://www.rorsecurity.info](http://www.rorsecurity.info) .

> ## Regards
> 
> Dave

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![daveelman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/bcef8e/32.png) [@daveelman](https://www.ruby-forum.com/u/daveelman)\
**Post date:** [November 12, 2009, 1:20pm UTC](https://www.ruby-forum.com/t/sessions/178784/5 "2009-11-12T13:20:26Z")

</div>

In message  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid), Kemal  
Pince [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes

> Read “Agile Development with Rails” by the God of Rails, David Heinemeier  
> Hansson. Or anything he has written. Doesn’t get any better.

Thanks, yes I’ve read chapter 26: Securing Your Rails Application.

In message  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid), Hassan  
Schroeder [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes

> I would start by reading the HTTP RFC(s).

Yes

In message [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid), Marnen  
Laibow-Koser [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes

> Dave E. wrote:

> > I’m interested in understanding how to harden a Rails application
> 
> Do you need to? The framework already plugs a lot of common loopholes  
> (provided the app doesn’t do stupid things). See if Rails is already  
> doing what you need.

Of course

> Also check out [http://www.rorsecurity.info](http://www.rorsecurity.info) .

Thanks

I’ve now downloaded the book, too

[http://www.owasp.org/index.php/File:Owasp-rails-security.pdf](http://www.owasp.org/index.php/File:Owasp-rails-security.pdf)

## Regards

Dave