Ruby on Rails: fix cards and security baseline

Fix cards for Ruby on Rails

Not covered in Rails yet

These weaknesses have fix cards in other stacks but not in this one.

• CORS misconfiguration on credentialed APIs
• XML external entity (XXE) processing
• Insecure randomness for security tokens
• Weak password hashing
• Code injection
• LDAP filter injection
• NoSQL operator injection
• OS command and argument injection
• Server-side template injection
• XPath injection
• Clickjacking
• Regular-expression denial of service (ReDoS)
• Unbounded resource consumption
• Hard-coded secrets
• Improper TLS certificate validation
• JWT validation in APIs (bearer tokens)
• CRLF injection in logs and response headers

Supported versions

Each minor release series gets bug fixes for one year and security fixes for two years after its first release; a new minor release is planned about every six months, and if none ships within a year the previous series stays supported until one does. Unsupported series get no new releases. Rails support policy.

ruby-lang.org lists each branch as in normal maintenance (bug and security fixes), security maintenance (security fixes only) or end of life, with its expected end date. Rails 8.1 needs Ruby 3.2.0 or later, and Ruby 3.2 reached its end of life on 1 April 2026. Ruby release schedule

How the fix cards choose versions

Minimum secure versions

The lowest release in each supported line that fixes every published advisory listed here. Anything older is missing a security fix.

Middleware and security order

1. ActionDispatch::HostAuthorization: First in the stack; it checks the Host header against config.hosts, which is empty, so off, outside development until you set it.
2. ActionDispatch::SSL: Added by config.force_ssl = true: redirects HTTP to HTTPS, sends HSTS and marks cookies Secure. Set config.assume_ssl = true too when a proxy terminates TLS.
3. ActionDispatch::Cookies, the session store, ActionDispatch::Flash: Cookies are signed or encrypted with secret_key_base; the session store (cookie store by default) comes after them.
4. ActionDispatch::ContentSecurityPolicy::Middleware: Sends the policy from config.content_security_policy, which a new app leaves commented out.
5. Controller callbacks: protect_from_forgery with: :exception (added to ActionController::Base by load_defaults 5.2 and later), then authentication in before_action, then strong parameters and queries scoped to current_user in the action.

Secure defaults and settings

Escape hatches to search for

Framework APIs that switch a protection off. Each one is sometimes needed; search for them in review and make each use justify itself.

Checklist, mapped to ASVS 5.0.0

• v5.0.0-1.2.1 Views rely on ERB escaping; no request data reaches raw, html_safe or <%==.
• v5.0.0-3.5.1 Forgery protection is on and no controller that reads the session cookie skips it.
• v5.0.0-8.2.2 Actions load records through scopes built from current_user.
• v5.0.0-1.2.4 No SQL fragment is built by string interpolation.
• v5.0.0-15.3.3 Controllers permit explicit keys; no permit! or to_unsafe_h reaches a model.
• v5.0.0-3.7.2 Redirects to request data go through url_from, and no allow_other_host: true takes request data.
• v5.0.0-7.2.4 Sign-in calls reset_session.
• v5.0.0-3.4.1 config.force_ssl (or the proxy) sends HSTS for at least a year.
• v5.0.0-3.3.1 Session and other cookies are Secure.
• v5.0.0-13.4.2 consider_all_requests_local is false in production, so errors show the generic page.

References

1. Rails: maintenance policy and supported releases
2. Ruby: maintenance branches
3. Rails Guides: Securing Rails Applications
4. Rails Guides: configuring Rails applications (middleware and defaults)
5. Rails Guides: Rails on Rack, the internal middleware stack
6. GHSA-xr9x-r78c-5hrm: arbitrary file read in Active Storage variant processing (CVE-2026-66066)
7. Rails Versions 7.2.3.1, 8.0.4.1 and 8.1.2.1 have been released (ten advisories)
8. Rails Version 7.2.4 has been released (the last 7.2 release)