Ruby/Rails Engineer
I had a wonderful shower the other day. It was late morning (as the best showers often are) and I was reflecting on how I spend my time during the day. As a work-from-home consultant, I constantly need to justify my billing and my time, and in this case I was justifying spending more of it in the shower. Like most of us, I started my career with the impression that a productive day was spent…
I was recently investigating the feasibility and capability of browser-based Geolocation, especially on mobile devices as an alternative to native mobile development. The Geolocation API is a W3C standard that defines a high-level JavaScript API for websites to query the physical position of a device. According to the ever-useful MDN docs , the APIs are well-supported. There are two ways to…
Many applications aim to prevent user enumeration during authentication, particularly if users authenticate themselves with some PII like an email address. Well-designed login forms usually don’t disclose whether the username or password is incorrect, both because the response can be misleading, 1 and because it will disclose the presence of accounts in the database, facilitating spear-phishing,…
In my previous post we looked at generating unique, random tokens to securely identify records with. While UUIDs solve this problem well, they are unweidly. In some cases, it’s handy to have an identifier that’s shorter and hence easier to read out. Naturally, the problem with shorter tokens is collisions. As we reduce our available pool of tokens, the chance that a randomly selected one will be…
Generating some kind of token for records is a common problem in web development. Fortunately, UUIDs are designed precisely for generating unique, random IDs or tokens. For most applications, you’ll probably want a fully random v4 UUID , which you can easily generate with SecureRandom in Ruby’s standard library. require 'securerandom' SecureRandom . uuid # => "16fc1d86-7d6e-4011-9b75-d6cd9501fe1e"…
Although ActiveRecord uniqueness validations aren’t bullet-proof, 1 they’re often helpful. Unfortunately, they can add overhead to save operations, since they require an extra call to the database. Consider the following simple ActiveRecord class: class SubscriptionPlan < ActiveRecord :: Base validates :code , uniqueness: true validates_uniqueness_of :name end When we try to create this we’ll see…