Last week, while creating a small Rails app for myself, I had to import data from an XML file. I wanted to add a command line task for it. I could’ve used rake for this, but I needed to input the path to the file through a command line parameter, and rake isn’t ideal for that. Fortunately, there’s another tool that’s better suited for this task: Thor.

Today, I want to tell you about open redirect vulnerabilities and how to prevent them in a Rails application.

This week, I want to cover a common compliance requirement. If you ever went through a PCI, ISO 2007, SOC2, or similar compliance questionnaire, you found the following question in one form or another:

This week I will show you another Rack Attack trick.

But before I get to that, I’d like to let you know that my book is finally done and if you want to learn about how to avoid security issues during code review, you should read it: Secure code review for Rails Developers .

This week I want to tell you about the form_with Rails helper. It was introduced in Rails 5.1, and the goal of this helper was to unify the form_for and the form_tag helpers. form_for requires a model instance or a scope and puts the attributes into a hash, so usually when you needed a form in the past where you didn’t want to put them scoped into a hash, you used form_tag.