how to allow user to add html and javascript in my rails app

Question

I want to create a Rails app where users can create their blog in a subdomain like : user1blog.myapp.com, user2blog.myapp.com etc...

I want to allow users to add html and javascript (sometimes they need to add popups to their blog, or tracking code ...)

I see a lot of website which allow users to add scripts and html without any restriction, but How i can do that too without affecting the security of my Rails app ?

Community · Accepted Answer · 2017-05-23 12:20:37Z

0

There are multiple facets to this question:

Dynamic Subdomains:

Other questions address this:

Rails 4 Dynamic Subdomains

Ruby on Rails route for wildcard subdomains to a controller/action

short answer, there are many ways and it depends on your use case.

User submitted html, js

There are many solutions here as well.

I Suggest searching for "CMS" (Content Management System).

There are solutions like refinery, Comfy Mexican Sofa, and others. Again, it depends significantly on your use case.

Security of my Rails app

If you are allowing user submitted html and js, I would say that you are implicitly compromising the security of your site. Your Rails app itself might be securable, but that's a major thread of conversation about xss, auth[z/n], and other items. Again, highly dependent on your use cases.

edited May 23, 2017 at 12:20

CommunityBot

11 silver badge

answered Mar 2, 2015 at 23:21

cmonkey

4,2961 gold badge28 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

medBouzid Over a year ago

I know about subdomains but i don't think they resolve the security issue !! each time you say dependent in my use cases !!! I think my use case is very simple : find any type of solution to be secure and in the same time allow users to save javascript & html code. how sites like blogger and thumblr do ?

cmonkey Over a year ago

The problem is "the security issue" isn't identified in your question. What issue(s) are you worried about? For example, as a trivial case (that isn't good) - why can't you allow a form that allows arbitrary upload of files, with a text field for "subdomain"?

medBouzid Over a year ago

I don't specify an exact issue because I don't know about all the possibilities of attacks, but the main thing is preventing a user to get access to another user account, also i will have an admin area in my main domain which i won't other users to get access too...

medBouzid Over a year ago

also there is a monthly subscription, and i want the system to be secure enough ! I am open to all kind of ideas and suggestions...

cmonkey Over a year ago

In the meta section of this site (stackoverflow.com/help/dont-ask ) : "Your questions should be reasonably scoped. If you can imagine an entire book that answers your question, you’re asking too much." This comes close to that domain. I would suggest that you show what you've tried, what you expect, and how your current efforts/tech is insufficient in a specific manner, rather than a broad question such as this.

|

Collectives™ on Stack Overflow

how to allow user to add html and javascript in my rails app

1 Answer 1

6 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related