Metadata

ID: ruby-security/rails-basic-auth

Language: Ruby

Severity: Info

Category: Security

CWE: 798

Description

This rule advises against hardcoding basic authentication credentials directly in your Rails application. Hardcoded credentials pose a significant security risk as they can easily be exposed unintentionally, leading to unauthorized access to sensitive data or systems.

It is important to adhere to this rule because it promotes good security practices. By avoiding hardcoded credentials, you reduce the potential for security breaches and ensure that your application’s authentication mechanisms are robust and secure.

To avoid violating this rule, store your basic authentication credentials in a secure and encrypted format, such as environment variables or a secure credentials storage system. For instance, instead of hardcoding the password directly in the http_basic_authenticate_with method, you can fetch it from an environment variable like this: http_basic_authenticate_with :name => "dhh", :password => ENV['SECRET_PASSWORD'], :except => :index. This way, the actual password is not exposed in the code and can be securely managed outside of the application.

Non-Compliant Code Examples

class PostsController < ApplicationController
  http_basic_authenticate_with :name => "dhh", :password => "secret", :except => :index
end

Compliant Code Examples

class PostsController < ApplicationController
  http_basic_authenticate_with :name => "dhh", :password => secret, :except => :index
end

Seamless integrations. Try Datadog Code Analysis

Datadog Code Analysis