ruby 49 lines · 9 steps

Safe post-login redirects in Rails

Store where a user was headed before login and validate it against an allowlist so attackers can't redirect them off-site.

Explained by highlit

Rails Intermediate open-redirect session authentication input-validation security

1class ApplicationController < ActionController::Base
ALLOWED_REDIRECT_HOSTS = [nil, ENV.fetch("APP_HOST", "app.example.com")].freeze
3 
def store_return_to(location = request.fullpath)
  return unless request.get? && !request.xhr?
6 
  session[:return_to] = location if safe_redirect?(location)
end
9 
def stored_location_for(_resource = nil)
  location = session.delete(:return_to)
  location if location.present? && safe_redirect?(location)
end
14 
def redirect_back_after_login(resource)
  redirect_to(stored_location_for(resource) || signed_in_root_path(resource))
end
18 
private
20 
def safe_redirect?(location)
  uri = URI.parse(location.to_s)
  return false if uri.path.blank?
  return false if uri.path.start_with?("//")
25 
  ALLOWED_REDIRECT_HOSTS.include?(uri.host)
rescue URI::InvalidURIError
  false
end
30end
31 
32class SessionsController < ApplicationController
def new
  store_return_to(params[:return_to].presence || request.referer)
end
36 
def create
  user = User.authenticate_by(email: params[:email], password: params[:password])
39 
  if user
    reset_session
    sign_in(user)
    redirect_back_after_login(user)
  else
    flash.now[:alert] = "Invalid email or password."
    render :new, status: :unprocessable_entity
  end
end
49end

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1Any user-supplied redirect target must be validated against an allowlist before you trust it.
2Storing the return path in the session lets you resume a user's intended destination after authentication.
3Parsing a redirect with URI and checking host and path shape defends against protocol-relative and off-site redirects.

Related explainers

ruby

require "shellwords"
require "open3"
 
module Backup

Building safe shell commands in Ruby

shell-out subprocess command-injection

Intermediate 7 steps

ruby

class UserAgentParser
  BROWSERS = [
    [/Edg\/([\d.]+)/, "Edge"],
    [/OPR\/([\d.]+)/, "Opera"],

Parsing user-agent strings in Ruby

regex pattern-matching lookup-tables

Intermediate 8 steps

python

import time
import uuid
 
from django.utils.deprecation import MiddlewareMixin

Attaching per-request context in Django

middleware request lifecycle multi-tenancy

Intermediate 7 steps

ruby

class LogAggregator
  BUCKET_FORMAT = "%Y-%m-%dT%H:%M"
 
  def initialize(entries)

Bucketing log entries by the minute in Ruby

aggregation hashing enumerable

Intermediate 5 steps

ruby

class WeeklySignupsReport
  DEFAULT_WEEKS = 12
 
  def initialize(weeks: DEFAULT_WEEKS, source: User.all)

Building a weekly signups report in Rails

service object aggregation group by

Intermediate 7 steps

ruby

class ApplicationController < ActionController::Base
  EXPERIMENTS = {
    checkout_button_color: %w[control blue green],
    onboarding_flow: %w[control streamlined]