sinatra-security

What problem does it solve?

Sinatra applications, like any web application, are vulnerable to common security threats such as CSRF, XSS, and SQL injection if not properly secured. This Skill provides essential best practices and implementation details to protect your application from these attacks.

Core Features & Use Cases

• CSRF Protection: Implement Rack::Protection and manual token generation for robust cross-site request forgery defense.
• XSS Prevention: Strategies for template escaping, secure JSON encoding, and Content Security Policy to mitigate cross-site scripting attacks.
• SQL Injection Prevention: Utilize parameterized queries and strong input validation to guard against database injection attacks.
• Authentication & Authorization: Patterns for password, token, and API key authentication, plus role-based and permission-based authorization for secure access control.
• Use Case: A developer is building a new Sinatra API and needs to ensure it's secure against common web attacks. This Skill guides them through implementing CSRF tokens, sanitizing user input, using secure authentication methods, and setting up robust authorization checks, ensuring the application is protected from day one.

Quick Start

Enable Rack::Protection for CSRF and other protections

use Rack::Protection

Secure sessions with a strong secret

use Rack::Session::Cookie, secret: ENV['SESSION_SECRET'], same_site: :strict, httponly: true, secure: production?

Parameterized query to prevent SQL Injection

DB["SELECT * FROM users WHERE email = ?", email]