Rails 3.2-从客户端应用程序发送POST请求会带来任何安全风险吗？

Question

I am planning on creating a client application in .NET that would send an HTTP POST request to my Rails application in order to update a given value in a database table. I'm using PostgreSQL as a database for my Rails app. As part of the POST request, I would need to send parameters with the URL to specify the information I'd like to update. Rails would then process the parameters and update the correct information in the database.

I feel that this could easily be a security risk since it seems that anyone could theoretically send a POST request with different parameters to modify the database. I know Rails has authentication tokens built into POST requests, so my intuition would be that my .NET requests would be rejected.

I was wondering if anyone could provide me with a little more insight on this topic. Would my requests be accepted by Rails, and if so, what protections might be in place to stop anyone from making a POST request to the server?

Thanks in advance!

Answer 1

Yes your rails app will accept the post if you have your routes.rb file setup correctly.

What you are really asking is "How do a create a save/secure API in my rails app?"

I have done this quite a bit and what we do is have some kind of authentication process. This may be a shared key (base plus some semi random portion) that is encrypted during transmission, or an actual sign in process.

My suggestion is to have a shared key that you encrypt and include in your POST header. You can retrieve it with something like

token = request.env['HTTP_AUTH_TOKEN']

then just decrypt it and verify the semi random portion before accepting the POST