rails-security-checklist

rails-security-checklist copied to clipboard

Are these measures a worthwhile exercise?

• Strip server version and any other revealing headers
• Remove default rails new-generated assets from public/
• Custom error pages that aren't the default Rails error pages
• Avoiding default routes for engines such as Devise
• Customize revealing meta tags such as CSRF token names?
• Are cookie names/contents revealing?
• Avoid default names and paths for assets, application.js, application.css