Avoid hardcoded basic auth with rails
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
ID: ruby-security/rails-basic-auth
Language: Ruby
Severity: Info
Category: Security
CWE: 798
Description
This rule advises against hardcoding basic authentication credentials directly in your Rails application. Hardcoded credentials pose a significant security risk as they can easily be exposed unintentionally, leading to unauthorized access to sensitive data or systems.
It is important to adhere to this rule because it promotes good security practices. By avoiding hardcoded credentials, you reduce the potential for security breaches and ensure that your application’s authentication mechanisms are robust and secure.
To avoid violating this rule, store your basic authentication credentials in a secure and encrypted format, such as environment variables or a secure credentials storage system. For instance, instead of hardcoding the password directly in the http_basic_authenticate_with method, you can fetch it from an environment variable like this: http_basic_authenticate_with :name => "dhh", :password => ENV['SECRET_PASSWORD'], :except => :index. This way, the actual password is not exposed in the code and can be securely managed outside of the application.
Non-Compliant Code Examples
class PostsController < ApplicationController
http_basic_authenticate_with :name => "dhh", :password => "secret", :except => :index
end
Compliant Code Examples
class PostsController < ApplicationController
http_basic_authenticate_with :name => "dhh", :password => secret, :except => :index
end
