Rails, Angular, Postgres, and Bootstrap

Chapter 2Secure the Login Database with Postgres Constraints

Our registration and login system looks great, thanks to Bootstrap, and works great, thanks to Devise. But it’s not as secure as we’d like. As you recall, we used validations to prevent users from registering with a non-company email address. Because this is done in Rails, it’s easily circumventable using Rails’s APIs or a direct database connection. Even something unintentional like bugs in our code could introduce vulnerabilities.

What we’d like is to prevent non-company email addresses getting into the database entirely. Most SQL databases do not have powerful features for preventing bad data. With Postgres, however, we can, by using a feature called check constraints. This chapter ...