Killing IDORs in Rails Applications: Make the Database Say "No" By Default (opens in new tab)

Learn how to prevent IDOR vulnerabilities in Rails applications by changing your authorization approach. Discover why scoping queries through associations is safer than "fetch then check", and understand the security risks of using unscoped vs unscope in ActiveRecord. Essential reading for Rails developers and security code reviewers.