Question

I have an app I’m writing in rails 3 w/ cancan and devise. I’m curious if authorizing post actions on your controllers is necessary or helpful from a security standpoint? Assuming all my controller actions require authentication w/ devise (ie user must be logged in).

I can see why I need authorization through cancan on my controller actions that use GET’s since a user can simply input the url they wish to visit freely and this must be locked down. However, with posts the user must post the data from a form, which is protected against an xss attack with a token.

In this case would it be safe to assume that if i limit the visibility of, say, a button in my view with cancan that the user wouldn’t be able to submit a form maliciously?

Thanks alot

EDIT:

Thanks for the quick answer guys. As it has been pointed out below a malicious user can forge a form post using tools such as firebug and thus authorization is necessary.

What would be the best way to simulate this type of interaction (a user posting to an url with a form they’ve hacked) using capybara / cucumber?

Thanks again.

Answer 1

A user can submit a POST request regardless of whether they are on your website or not. You’re correct in thinking that the security token will help prevent XSS, but I would add authentication in for other methods of attacks.

A good (free) ebook to read if you’re concerned about security is the Ruby on Rails Security Guide. It outlines all common forms of malicious attacks and even explores some of the lesser used (but just as effective) methods. It also gives great solutions on how to make your application more secure.