[Issue #12] Security Audit

[SammySteiner]

Ticket

• Resolves #12

Changes

Added application-security.md file in the docs/app-rails folder based on this railsdoc https://guides.rubyonrails.org/v7.1/security.html.

Context for reviewers

• Please read through the file and give feedback if the content is clear and concise.
• Note there are 16 TODO items, please give feedback if any of those need clarification or discussion.
• I'm not super familiar with Rails and may have completely miss understood some of the recommendations as well as how we implemented things in the template, please let me know if you this I may have misunderstood something.

[SammySteiner]

@SammySteiner My high level feedback is related to the template nature of this repo. The audience for this document should be engineers who are working on an application based on this template, not engineers working on the template (i.e. us).

I suggest that you re-organize this document into a checklist of best practices that the template is currently doing, a checklist of best practices that the template is not yet doing. For anything that could be added in the future (i.e. not a one-time configuration setting, but something to check again if the application develops), add a note that calls that out.

For example, something like this:

• [x] SSL (config.force_ssl = true) is enforced in production environments.
• [ ] CSRF protection is enabled in production environments.

• [ ] Expire sessions after a set amount of time, regardless of activity.

  • NOTE: This should be enforced by the auth service, such as by AWS Cognito.

• [ ] For all forms accessible by non-authenticated users, configure honeypot fields and logic to thwart bots.

  • ONGOING NOTE: Check this anytime a new form is added to the application.

Thanks @rocketnova! This is the guidance I needed to take this doc from personal notes as I was reading through the documentation to something that's useful and digestible for other people.

[SammySteiner]

@rocketnova Created Tickets:

1. Add honeypot field and honeypot field logic as feature request
2. Enable forgery protection
3. Add multiline: true to our regex format: in validations.
4. Define a content security policy
5. Configure host protection