Loading…
0+ curated questions with the same answer shape every time: quick recap, deep dive, pitfalls, and follow-ups. Coverage includes .
Rails security interview questions test whether you know what Rails protects you from by default and — critically — how engineers accidentally disable those protections. This module covers Rails' built-in CSRF protection (protect_from_forgery with: :exception and how the token works), XSS prevention via automatic HTML escaping in ERB (and the html_safe/raw danger), SQL injection prevention via parameterized queries (and the danger of string interpolation in where), mass assignment protection via strong parameters, clickjacking protection via X-Frame-Options, OWASP Top 10 mapped to Rails with concrete examples, the Content-Security-Policy header, SameSite cookie policy, session fixation and reset_session, SSRF via open-uri, and the security implications of config.force_ssl and HSTS.
Full catalog
Topics are ordered for learning. Within each topic, rows are numbered 1–0 globally so you always know where you are. Collapse topics if you want a lighter view — use Expand all when you need the full list again.
Numbers 1–0 follow the order we recommend — click any row to open the full answer, or use the sticky Next link at the bottom of each page to go Q1 → Q0.