Checklist: Rails Authentication

Authentication is a special part of web applications. On the one hand, it usually is a crucial security mechanism restrict access to certain people and roles. On the other hand, most users authenticate only once, so it is very unlikely to spot issues by accident.

So, here comes a quick checklist to help you verifying your authentication solution is all set.

  • This should be default: use HTTPS with HSTS. The HSTS part is important.
  • Use a reliable authentication solution, e.g. Clearance Archive or [Devise...

Updated: A simpler default controller implementation (2022 update)

Invalid forms now re-render with a HTTP status 422 Unprocessable Entity.

This helps with handling server errors in Unpoly Archive .

What Sass means by "@function rules may not contain style rules."

When writing a Sass function, you may run into an error message that may be confusing:

@function rules may not contain style rules.

What Sass is trying to tell you is that a line in your Sass function is computing a result that is neither assigned to a variable nor returned.

Keep in mind that all functions in Sass return something, Sass does not mutate objects.

Chrome DevTools: Event Listener Breakpoints


In Chrome DevTools in the Sources tab you can active Event Listener Breakpoints for debugging events.


The Event Listener Breakpoints in the Chrome DevTools can be quiet useful for debugging why and where code is handling specific events.

Here you can see a very simple example that shows what lines of code handle a click:


You can use this Code Pen Archive if you want to try it yourself.



Updated: Nested ActiveRecord transaction pitfalls

Updated the card as we found a second way how you can shoot yourself in the foot with nested transaction.

Chrome DevTools: DOM Breakpoints - Breakpoints on HTML Elements


In Chrome DevTools in the Elements tab or in Firefox in the Inspector tab you can right click on an element and choose Break on to debug changes related to this element.


DOM Breakpoints can be quite useful to quickly find the JavaScript that is responsible for some (unexpected) behavior. You can use DOM Breakpoints for debugging subtree modifications, attribute modifications or node removal.

Here you can see a very simple example that shows what JavaScript lines are responsible for ...

Stop writing "require 'spec_helper'" in every spec

Simply add this to your .rspec instead:

--require spec_helper

If you are on rspec >= 3 and use a rails_helper.rb require this instead of the spec_helper:

--require rails_helper

If you are using parallel_tests and this is not working for you, .rspec might be ignored. Try using a .rspec_parallel file.

Escape a string for transportation in a URL

To safely transport an arbitrary string within a URL, you need to percent-encode Archive characters that have a particular meaning in URLs, like & or =.

If you are using Rails URL helpers like movies_path(:query => ARBITRARY_STRING_HERE), Rails will take care of the encoding for you. If you are building URLs manually, you need to follow this guide.


In Ruby, use CGI.escape:

=> "foo%3Dfoo%26bar%3Dbar"

Do not ever use URI.encode or ...

Capybara/Selenium: evaluate_script might freeze your browser, use execute_script

In a nutshell: Do not use evaluate_script. Use execute_script instead!
Modern capybara will also bring evaluate_async_script. For details, see here.

Capybara gives you two different methods for executing Javascript:


While you can use both, the first line (with evaluate_script) might freeze your browser window for 10 seconds.

The reason is that `...

GitLab: Git alias for creating a merge request on push

Git allows you to set push options when pushing a branch to the remote.
You can use this to build an alias that automatically pushes a branch and creates a merge request for it.

Put this in your ~/.gitconfig in the [alias] section:

mr = push origin HEAD -o merge_request.create -o merge_request.draft

Now you can do git mr and a draft merge request will be created.
Target branch is your project's default branch, i.e. main or master.

To specify a different target branch, add -o

There ...

Updated: Fixing flaky E2E tests

Added a section Further readings for related cards and put a recent card to that section.

Chrome DevTools: Quick Bite - Store Element in Global Variable


In the Elements tab in the Chrome DevTools you can right click on an element and select Store as global variable.



How to: Use git bisect to find bugs and regressions

Git allows you to do a binary search across commits to hunt down the commit that introduced a bug.

Given you are currently on your branch's HEAD that is not working as expected, an example workflow could be:

git bisect start # Start bisecting
git bisect bad # Tag the revision you are currently on (HEAD) as bad. You could also pass a commit's SHA1 like below:
git bisect good abcdef12345678 # Give the SHA1 of any commit that was working as it should
# shorthand:
git bisect start <bad ref> <good ref>

Git will fetch a comm...

How to organize monkey patches in Ruby on Rails projects

As your Rails project grows, you will accumulate a number of small patches. These will usually fix a bug in a gem, or add a method to core classes.

Instead of putting many files into config/initializers, I recommend to group them by gem in lib/ext:


Taking screenshots in Capybara

Capybara-screenshot Archive can automatically save screenshots and the HTML for failed Capybara tests in Cucumber, RSpec or Minitest.

Requires Capybara-Webkit, Selenium or poltergeist for making screenshots. They're saved into $APPLICATION_ROOT/tmp/capybara

The attached files contain config for cucumber integration and a Then show me a screenshot step.
If your project uses Spreewald Archive , you can use its Then show me the page step instead.


ActiveType::Object: Be careful when overriding the initialize method


ActiveType::Object inherits from ActiveRecod::Base and is designed to behave like an ActiveRecord Object, just without the database persistence.

Don't remove any of the default behavior of the initialize method!

If you have a class which inherits from ActiveType::Object and you need to override the #initialize method, then you should be really careful:

  • Always pass exactly one attribute. ActiveRecod::Base objects really want to get their arguments processable as keyword arguments. Don't change the syntax, or y...

Temporary solution for connection errors with rubygems

The problem

If you're experiencing that your bundle install command fails with an error message like this, might have issues with their ipv6 connectivity:

$ bundle install
Fetching source index from

Retrying fetcher due to error (2/4): Bundler::HTTPError Could not fetch specs from due to underlying error <timed out (>

The (a little bit dirty) possible solution

If that's actually the case, then you can try to deprioritize the ipv...