Hire the Best Ruby Developers & Programmers

Clients rate our Ruby Developers & Programmers
Rating is 4.7 out of 5.
4.7/5
Based on 4,636 client reviews
Sanjeev S.

Kathua, India

$23/hr
4.7
201 jobs

๐Ÿ‘‹ Hello, Iโ€™m Sanjeev. With 13+ years of experience, I help startups and established companies build reliable, fast, and user-friendly CRMs, enterprise solutions, and e-commerce platforms. ๐Ÿ’ป Front-End Expertise Angular, React, Vue & Ember.js โ†’ portals, dashboards, and CRMs โš™๏ธ Back-End Systems Laravel, Node.js, Ruby on Rails, PHP ๐Ÿข CRM Solutions Workflow automation, Client portals, Custom CRMs ๐Ÿ›’ E-Commerce Solutions Custom builds for WordPress, Shopify, and Magento ๐Ÿค– Automation & Integrations Third-party integrations, Chatbots, Reporting systems โœจ Why Clients Choose Me โœ… 165+ successfully completed projects โœ… 13,500+ Upwork hours โœ… 100% Job Success โœ… Top Rated Plus Long-term trust, reliable updates, and transparent communication ๐Ÿ’ฌ What Clients Say โ€œProvided a good solution ahead of schedule.โ€ โ€œOne of the best independent contractors Iโ€™ve ever dealt withโ€”a superb communicator and coder.โ€ โ€œKnowledgeable Ember.js developer, consistently delivers.โ€ ๐Ÿ‘‰ Please get in touch with me or schedule a meeting to talk about your project if you're searching for a trustworthy developer to realize your ideas. #FullStackDeveloper #Angular #EmberJS #Laravel #NodeJS #RubyOnRails #CRMDevelopment #EcommerceDevelopment #Shopify #Magento #WordPress #AIAssistedDevelopment #WebDevelopment #EnterpriseSolutions #APIIntegration #Automation - Ember.js Developers & Programmers - CRM Developers - E-commerce Developers - Drupal Developers - Adobe Commerce (Magento) Developers - Drupal Developers

  • PHP
  • Laravel
  • Node.js
  • Ember.js
  • Ruby on Rails
  • React
  • AI Development
  • Python
  • Shopify
  • Yii2
  • WooCommerce
  • Page Speed Optimization
Aliaksandr H.

Warsaw, Poland

$20/hr
4.9
86 jobs

Hello. I'm an AI engineer, full-stack iOS/Android/PHP/JavaScript/TypeScript/React/React Native developer and problem solver with more than 17 years of experience iOS/Android/PHP/JavaScript/TypeScript/React/React Native developer and problem solver with more than 17 years of experience. Specializing in MERN and LAMP stacks, artificial intelligence (AI). I embrace modern AI-powered development workflows using tools like ๐Ÿค– Claude Code, ๐Ÿง  Cursor and ๐Ÿ„ Windsurf IDEs. What I do: ๐Ÿ“ฑ Mobile apps, ๐Ÿ–ฅ๏ธ Desktop apps, ๐ŸŒ Websites, โš™๏ธ Web services, ๐Ÿ‘จ๐Ÿปโ€๐Ÿ’ป Admin Backends, ๐Ÿงฉ API for them, ๐Ÿค– ChatGPT integrations. I embrace modern AI-powered development workflows using tools like ๐Ÿง  Cursor IDE and ๐Ÿค– Claude Code. Kinds of software I've created: ๐Ÿ›๏ธ Shopping & online stores, ๐Ÿƒ Sports, ๐ŸŽฎ Games, ๐Ÿง˜ Medicine & well-being, โœˆ๏ธ Travel, ๐Ÿ’ฐ Bank systems, ๐Ÿ“ฃ Ad networks, ๐Ÿ›ก๏ธ Insurance, ๐Ÿ›ฌ Landing pages. I have strong skills in the following programming languages: ๐Ÿ“œ TypeScript, โ˜• JavaScript, ๐Ÿฆ… Swift, ๐ŸŽฏ Objective-C, ๐Ÿ˜ PHP, ๐Ÿฑ Kotlin, โ˜• Java. Frameworks and technologies: ๐Ÿฆ• Deno & Node, โš›๏ธ React, โš›๏ธ React Native, ๐Ÿค– ChatGPT API, ๐Ÿ”ฎ Anthropic AI API, ๐Ÿป Zustand, โš›๏ธ Electron, ๐Ÿ† Redux, ๐Ÿ† Redux Toolkit, ๐Ÿ† Nest js, ๐Ÿ…ฝ Next js, ๐Ÿ†… Vue, ๐Ÿ† Fastify, ๐Ÿฅค Fresh, ๐Ÿ…ฐ Apollo GraphQL Client and Server, ๐Ÿ”Œ Relay, ๐Ÿ…ผ MobX, ๐ŸŒณ Koa, ๐Ÿ…ด Express js, ๐Ÿ“ˆ GraphQL, ๐Ÿ˜Ž Swagger, ๐Ÿ’จ Tailwind, ๐Ÿฆ… SwiftUI, ๐ŸŽฅ Lottie Files, ๐Ÿฅค Cocoa Touch, ๐Ÿฅฅ Cocos2D, ๐Ÿ…ป Laravel, ๐ŸŽต Symfony, ๐Ÿ†ˆ YII and YII2, ๐Ÿ”ฅ CodeIgnitor, ๐Ÿ†‰ Zend Framework, ๐Ÿ“ CoreLocation, ๐ŸŽฅ CoreAnimation, ๐Ÿ  Apple HomeKit, โค๏ธ Apple HealthKit, ๐Ÿ’ฐ Superwall. Databases: ๐Ÿƒ Mongo, ๐Ÿฌ MySQL, ๐Ÿชถ SQLite, ๐Ÿ‰ Watermelon DB, โšก๏ธ Supabase, ๐Ÿ”ฅ Firebase, ๐Ÿ˜ Postgres, ๐Ÿ“„ TypeORM, โžก๏ธ Doctrine, โšช DynamoDB/PartiQL, ๐Ÿ”ด Oracle, ๐Ÿ…ฒ CoreData, ๐ŸŸฃ Realm. Cloud Computing: ๐Ÿณ Docker, โ˜ธ๏ธ Kubernetes, โ˜ธ๏ธ Google Kubernetes Engine, ๐ŸŒŠ DigitalOcean Cloud, ๐Ÿ…ท Heroku, ๐Ÿ† Render, โ˜€๏ธ Netlify, ๐Ÿ…ฐ Microsoft Azure, ๐Ÿ”บ AWS Lambda. I have developed over 20 iOS apps, 15 React Native apps, several Android apps, APIs for some of them, over 20 websites. I'm proficient in problem-solving and have solid track record of success in solving complex problems for teams that have struggled to do so on their own. I like to explore modern technologies, build amazing user interfaces, develop software of any complexity. I always strive to create apps and sites according to the best practices, thoroughly test them and provide the best user experience. It's important to me to write clean and readable source code which is easy to understand and maintain for any other developer.

  • Hybrid App Development
  • Objective-C
  • Swift
  • PHP
  • Java
  • MongoDB
  • React Native
  • Firebase
  • API Integration
  • iOS Development
  • Laravel
  • Database Development
  • Yii
  • UX & UI
Anton T.

Chicago, Illinois

$57/hr
5.0
81 jobs

Iโ€™m a Chicago-based software leader and founder of Gotoinc โ€” a full-stack Talent-as-a-Service agency, focused on Ruby-powered solutions. We work with founders, engineering, and product leaders who need reliable talents, proficient in UI/UX design, front-end engineering, back-end engineering, and DevOps. This is a group of vetted professionals Iโ€™ve personally built and led over the years. We help: - Launch and scale Ruby on Rails platforms - Modernize legacy Rails applications - Improve performance and system architecture - Ensure long-term maintenance and reliability - Design a clean, intuitive UI/UX for complex workflows Among our projects: - FinTech platform associated with Growth Hacking creator Sean Ellis. We supported a private equity and fund services technology platform operating in complex financial environments. - HIPAA-compliant telemedicine platform for US-regulated markets. Long-term collaboration on a healthcare platform operating across multiple US states under strict regulatory and compliance requirements, handling sensitive medical data at scale. - EdTech ecosystem with IPO-level Due Diligence (GNS stock). We worked 7โ€“8 years with GeniusU, supporting the platform through significant Due Diligence processes related to IPO readiness. At one stage, nearly the entire engineering team (except the CTO) was on our side. - IoT cybersecurity product (Product Management & UI/UX). We led product management and UI/UX for a security-focused IoT platform, specializing in complex dashboards, control panels, and data-heavy systems. - Enterprise collaboration with The Access Group (US division). After one of our previous projects was acquired, we were recommended as a key technical provider during the early-stage scaling within a larger enterprise structure. We work through 2 options: - Talents-as-a-Service model. A dedicated expert(-s) on a subscription basis. - Project-Based Collaboration model. We deliver a certain scope or solution in a pre-defined timeline/budget. How to start: 1. Having an intro, where we identify your request 2. Our team identifies specific Talent or Team for your request 3. We deeply research your request and outline a collaboration proposal for your specific case 4. Proposal presentation and negotiations 5. Paperwork 6. Collaboration kick off

  • React
  • Node.js
  • Ruby on Rails
  • Web Development
  • API Development
  • Full-Stack Development
  • Web Application
  • App Development
  • Developmental Editing
  • AWS Development
  • Back-End Development
  • Front-End Development
  • SaaS Development
  • Security Engineering
  • Software Development
Zlata B.

Kyiv, Ukraine

$40/hr
5.0
2 jobs

Hi, Iโ€™m Zlata. Iโ€™m basically a typical American software developer... just living in Ukraine now. And I always work in the EST timezone. Iโ€™ll write everything in any tech stack you have ๐Ÿ˜„ Iโ€™m a Software Engineer with 8+ years of experience as a Ruby on Rails developer, React developer, Node.js developer, Python developer, and .NET developer. I work with Ruby on Rails, React, Node.js, Python, .NET, PostgreSQL, Docker, AWS, JavaScript, TypeScript, API development, API integration, and SaaS software development. I help companies build and improve SaaS platforms, ERP systems, CRM tools, dashboards, marketplaces, internal systems, API products, and complex web applications using Ruby on Rails, React, Node.js, Python, and .NET. My focus is clean product logic, stable delivery, scalable architecture, and software that stays easy to maintain as the business grows. ๐Ÿ“Š My Achievements in Numbers: ๐Ÿ”ถ Ruby on Rails Developer for a Construction Application Platform โ–ช Helped build a Ruby on Rails + React platform for managing construction applications, reviews, documents, and stakeholder workflows. โ–ช Reduced application review time by 42%. โ–ช Supported 18,500+ construction applications processed in the first year. โ–ช Helped the product reach $1.4M ARR within 14 months. โ–ช Worked with Ruby on Rails, React, PostgreSQL, Docker, AWS, S3, and API integration. ๐Ÿ”ถ React Developer for a Construction Materials ERP SaaS โ–ช Helped improve a complex ERP SaaS platform for concrete, aggregates, and asphalt producers. โ–ช Improved sales, pricing, and operational workflows through better product logic and scalable software architecture. โ–ช 98% of demo users became clients after product improvements. โ–ช 91% of users rated the interface as clear and intuitive. โ–ช The product later raised $3.4M. โ–ช Focused on React, Ruby on Rails, SaaS workflows, API development, and complex web application structure. ๐Ÿ”ถ Node.js Developer for an Aviation Maintenance SaaS โ–ช Helped improve a complex aviation maintenance SaaS product used by field teams. โ–ช 96% of demo users became clients after the product improvements. โ–ช 97% of field users adopted the product after the first try. โ–ช Reduced user errors by 41% and made onboarding 62% faster. โ–ช Supported product logic, API integration, dashboards, and connected SaaS workflows using Node.js, React, Ruby on Rails, and API development. ๐Ÿ”ถ Python Developer for an AI Healthcare SaaS โ–ช Supported an AI-powered healthcare platform that grew from a chatbot into multiple AI agents for clinics and hospitals. โ–ช The product raised $20M+. โ–ช Helped support workflows that increased patient visits by 31%. โ–ช Helped reduce call abandonment by 98%. โ–ช Worked with Python, API integration, automation workflows, AI-related product logic, and scalable SaaS architecture. ๐Ÿ”ถ .NET Developer for a Utility Billing Platform โ–ช Helped improve utility billing workflows for a SaaS platform processing complex customer, billing, and reporting data. โ–ช Helped process $14M+ in utility bills within 6 months. โ–ช Reduced billing cycle time from 9 days to 1.5 days. โ–ช Supported 96% client retention through better product stability and workflow clarity. โ–ช Worked with .NET, React, API development, reporting logic, SaaS architecture, and reliable software delivery. Why should you hire me as a Software Engineer? โ–ช 8+ years of experience with Ruby on Rails, React, Node.js, Python, .NET, JavaScript, TypeScript, PostgreSQL, API development, API integration, and SaaS software development. โ–ช 120+ successful projects delivered across B2B SaaS, ERP, CRM, healthcare, construction, logistics, fintech, aviation, and internal business platforms. โ–ช Strong experience with Ruby on Rails, React, Node.js, Python, and .NET for SaaS products, dashboards, admin panels, API-first platforms, integrations, automation, AI features, and enterprise systems. โ–ช I use Claude, Cursor, GitHub Copilot, and ChatGPT to speed up research, debugging, refactoring, and delivery. โ–ช I work well with founders, CTOs, product managers, and teams that need clear communication across Ruby on Rails, React, Node.js, Python, and .NET products. What I can help you with: โœ”๏ธ Build or improve Ruby on Rails SaaS products โœ”๏ธ Create React dashboards, portals, admin panels, and SaaS interfaces โœ”๏ธ Build Node.js services and API integrations โœ”๏ธ Support Python automation, data workflows, and product logic โœ”๏ธ Work with .NET systems and connected software platforms โœ”๏ธ Build API-first products with Ruby on Rails, React, Node.js, Python, .NET, PostgreSQL, Docker, and AWS โœ”๏ธ Improve performance, stability, and maintainability of existing Ruby on Rails, React, Node.js, Python, and .NET applications โœ”๏ธ Support SaaS, ERP, CRM, fintech, healthcare, logistics, construction, and internal tools Need help with Ruby on Rails, React, Node.js, Python, .NET, API development, or SaaS development? Message me and letโ€™s discuss your product. ๐Ÿ“ฉ๐Ÿค

  • Ruby
  • Ruby on Rails
  • JavaScript
  • API
  • PostgreSQL
  • React
  • Node.js
  • Amazon Web Services
  • SaaS
  • TypeScript
  • Web Application
  • Python
  • Git
  • API Integration
  • API Development
  • React Native
  • Web Development
  • Mobile App Development
  • Docker
  • CSS
Charlie M.

Lowell, Massachusetts

$85/hr
4.3
10 jobs

Charlie Maere is a seasoned Information Technology expert with over 18 years of senior-level experience. He currently serves as the Global Digital Health and Data Analytics Director at the Elizabeth Glaser Pediatric AIDS Foundation. His areas of expertise span across multiple domains, including: Project Management Software Development, with proficiency in: Languages & Frameworks: Python, PHP, Angular, Ionic, Java, C++, Swift, C, C#, Ruby on Rails, JavaScript, Android, Flutter, React, Vuejs, nodejs. Hybrid/Mobile App Development Web Development Artificial Intelligence and Computer Vision, including: Retrieval-Augmented Generation (RAG) Large Language Models (LLMs) Computer Vision Predictive Modeling Classical Machine Learning Algorithms Firmware Development Cloud Computing, with experience in: AWS (Amazon Web Services) Microsoft Azure Systems Administration and Cybersecurity Strategic and Operational Planning Organizational Design and Scalable Network Architecture Information Systems and Machine Learning Collaborative Tools and ICT System Development Charlieโ€™s work is driven by a passion for innovation and digital transformation, particularly in strengthening ICT infrastructure and data-driven solutions within global health and development ecosystems.

  • Artificial Intelligence
  • Web Development
  • Mobile App
  • Python
  • Angular
  • Ionic Framework
  • Computer Vision
  • Microsoft Azure
  • Amazon Web Services
  • C++
  • Web Scraping
  • Vue.js
  • React
  • Electron
  • Swift
Christopher I.

Phoenix, Arizona

$90/hr
5.0
25 jobs

Hello! I have 20 years experience with web development. 17 of those years have been with a Ruby on Rails focus and accompanying DevOps. I also have extensive experience with client-side Javascript. I believe maintaining a high-level of communication during a project is paramount to the success of a project, in addition to it finishing on-time and on-budget. Software development is my business, I'm not moonlighting with a full-time job during the day. As such, I will not disappear one day to never be heard from again. Which unfortunately is a common situation with freelance developers. Additionally, I believe in high-quality software development practices like automated testing, test-driven development, continuous integration/delivery, daily stand-ups, etc All of this is with the end goal of helping businesses increase their return on investment with their software development projects. I have expert experience with the following technologies : - Ruby, Ruby on Rails - Javascript/Ecmascript 5+, Hotwire/Turbo/Turbolinks - HTML5, CSS3 - Nginx - Ubuntu, DevOps - Postgres, MySQL - Rackspace, AWS, Digital Ocean, Heroku - Background processing, Queuing (Resque/Sidekick) - REST, Web Services, SOAP - High-performance APIs (JSON/XML) - Payment Processing - Stripe, Braintree, Paypal, Chargify I also have general experience with: - Apache - Linux variants other than Ubuntu - ElasticSearch, Solr, Sphinx - MongoDB Thanks for reading if you made it this far. Let's make something great together!

  • Ruby
  • CSS 3
  • JavaScript
  • jQuery
  • HTML5
  • Ruby on Rails
  • RESTful Architecture
  • Agile Software Development
  • API Development
  • Test-Driven Development

How it works

Post a job for freePost a job

Tell us what you need. Create your own job post or generate one with AI then filter talent matches.

Hire top talent fast

Consult, interview, and hire quickly, so you can meet the freelancers you're excited about.

Collaborate easily

Use Upwork to chat or video call, share files, and track project progress right from the app.

Payment simplified

Manage payments in one place with flexible billing options. Only pay for approved work, hourly or by milestone.

Don't just take our word for it

How to Hire Top Ruby Developers

How to hire Ruby developers

From websites and domain-specific languages (DSLs) to desktop applications and IoT devices, a Ruby developer has the back-end programming expertise to bring your software projects to life.

So how do you hire Ruby developers? What follows are some tips for finding top Ruby development consultants on Upwork.

How to shortlist Ruby development professionals

As youโ€™re browsing available Ruby development consultants, it can be helpful to develop a shortlist of the professionals you may want to interview. You can screen profiles on criteria such as:

  • Technology fit. Whether itโ€™s mruby for IoT or Ruby on Rails for web development, you want a Ruby developer who is familiar with the type of software youโ€™re trying to build.
  • Test-driven development (TDD). The best way to avoid pitfalls on launch day is to test frequently during development and gain feedback from end users.
  • Feedback. Check reviews from past clients for glowing testimonials or red flags that can tell you what itโ€™s like to work with a particular Ruby developer.

How to write an effective Ruby development job post

With a clear picture of your ideal Ruby developer in mind, itโ€™s time to write that job post. Although you donโ€™t need a full job description as you would when hiring an employee, aim to provide enough detail for a contractor to know if theyโ€™re the right fit for the project.

Job post title

Create a simple title that describes exactly what youโ€™re looking for. The idea is to target the keywords that your ideal candidate is likely to type into a job search bar to find your project. Here are some sample Ruby job post titles:

  • Back-end developer needed with Ruby on Rails experience
  • Full-stack Ruby on Rails developer needed.
  • Ruby programmer needed to build a domain-specific language (DSL)

Ruby project description

An effective Ruby job post should include:

  • Scope of work: From MVPs (minimum viable products) to full-featured SPAs (single-page applications), list all the deliverables youโ€™ll need.
  • Project length: Your job post should indicate whether this is a smaller or larger project.
  • Background: If you prefer experience with certain industries, software, or developer tools, mention this here.
  • Budget: Set a budget and note your preference for hourly rates vs. fixed-price contracts.

Ruby developer job responsibilities

Here are some examples of Ruby developer job responsibilities:

  • Translate technical requirements and UI/UX designs into code
  • Integrate UI to a Ruby on Rails back end
  • Handle database design and business logic layer of an application
  • Build, test, deploy, and maintain a Ruby-powered application

Ruby developer requirements and qualifications

Be sure to include any requirements and qualifications youโ€™re looking for in a Ruby developer. Here are some examples:

  • Ruby programming language
  • mruby for embedded systems such as IoT devices
  • Ruby on Rails for back-end web development
  • RESTful services, APIs, and third-party library integrations
  • Experience running unit tests
  • Version control systems such as GitHub
>

Ruby Developers FAQ

Frequently asked questions

What is Ruby?

Ruby, along with its framework, Ruby on Rails (โ€œRailsโ€), is an incredibly efficient, high-level back-end programming languageโ€”a big draw for start-ups and small development teams that need to get complex, heavy-traffic applications up and running in a short time. Rails lightens the workload for developers with a library of โ€œgemsโ€โ€”prepackaged code that streamlines development in a big way.

But what really sets Ruby apartโ€”especially when stacked up against its biggest competitor, Pythonโ€“is โ€œprogrammer happiness.โ€ Ruby is attracting lots of developers who prefer its elegant โ€œdo more with lessโ€ philosophyโ€”and these developers are in demand.

How much does it cost to hire a Ruby developer?

The first step to determining the cost to hire a Ruby developer will be to define your needs. Rates can vary due to many factors, including expertise and experience, location, and market conditions. Learn about the cost to hire Ruby developers.

Common Ruby developer mistakes

Overusing method_missing: Nobody likes repetitive code, and metaprogramming with method_missing is one of those guilty pleasure catchalls we like to throw into our code to avoid errors at runtime and just make it work.

Need to allow one class to quickly use the methods available in another class?

Use method_missing.

Have numerous methods but donโ€™t want to name them all explicitly?

Use method_missing.

Need to build lots of methods that are virtually identical except for a few slight differences?

Use method_missing.

Thereโ€™s just one problem with method_missing: Itโ€™s slow. Every time you call method_missing, the Ruby runtime must climb up your class chain hierarchy to find the method that actually does the heavy lifting that allows your code to work. Most benchmark tests show that method_missing is significantly slower at runtime than if you were to use plain old Ruby methods. A faster metaprogramming tool for the example cases above is define_method, which allows you to dynamically define methods that load when your classes are loaded.

So when should method_missing be used? When youโ€™re dealing with dynamically named methods based on a pattern and you canโ€™t reasonably expect to be able to predict all the possible method name combinations. Rubyโ€™s own Active Record dynamic finders are probably the best example of this. For example, if you wanted to find a user by email from a large data set of users, and your user has an email attribute, you could use User.find_by_email(โ€˜john.doe@example.comโ€™) even though you never explicitly defined that method under the User or ActiveRecord::Base classes.

Relying too heavily on gems: Every new Rails developer reaches a certain point in their careers where they fall prey to the siren song of the RubyGems repository. And how can you resist? Rubyโ€™s extensive catalog of gems is supported by a vibrant open-source community. Need help with authentication? Try Devise. What about authorization? CanCanCanโ€™s got you covered. If thereโ€™s a task that you need help with, chances are good that thereโ€™s a gem for that.

Unfortunately, as with all other things in life, itโ€™s possible to have too much of a good thing. As powerful as gems are, there comes a point where youโ€™ll begin to notice a trade-off between programmer productivity and performance with every new gem. Too many gems can slow down performance, drain resources, and make tests take longer.

A bloated Gemfile can become a nesting ground for future application-breaking bugs. Higher-quality gems try to minimize dependencies as much as possible, but if you arenโ€™t careful you could find yourself managing hundreds of gems. At that point, whatever productivity you gained from having to write less code is eaten up in managing dependencies, chasing hidden bugs, and keeping your application up-to-date.

Whatโ€™s the solution? Moderation. Before you download a gem, ask yourself whether you can justify its use of resources and whether you need all the functionality that it has to offer. Being selective about your gems can help keep your application lean.

Application logic seeps into the view: Ruby on Rails follows the MVC (model-view-controller) pattern, where the model is responsible for data, the view is the visual representation of that data, and the controller forms the bridge between the two. The goal of this pattern is to decouple the major roles of an application in order to promote efficient code reuse and allow parallel development. Realizing that goal becomes difficult when you start to deviate from those roles.

Views should be concerned only with visual representation. However, it can be tempting to sneak application logic into your ERB templates like so:

<h2>
Congratulations
<% if winning_player %>
<%= winning_player.name %>
<% else %>
Contestant
<% end %>
</h2>

Not only can the inefficiency of placing application logic into individual views lead to repeating code, but managing a large jumble of Ruby and HTML code can make maintenance more difficult as your application scales. It is far better to encapsulate that logic into a reusable helper function, presenter, or decorator.

Taking โ€œfat model skinny controllerโ€ too far: Controllers do a lot of things, from session handling to rendering and redirectingโ€”but it basically boils down to a middleman between the model and the view, receiving requests and providing the appropriate output. By default, the controller already has a lot on its plate. To prevent the temptation of stuffing model or view logic in the controller, the โ€œfat model skinny controllerโ€ principle was born. Problem solved, right?

Not really. Now the problem of bloat has just been moved to the model. Every model should correspond to a data table in the database. The modelโ€™s corresponding data table should be its single responsibility. In a bid to keep views and controllers lean, it can be tempting to toss anything that doesnโ€™t quite fit into the MVC paradigm into the model. It turns out that many of the maintenance issues that plague bloated views and controllers also extend to the model. The solution is to use POROs (plain old Ruby objects) to encapsulate things that donโ€™t quite fit in any of the MVC categories.

Leaving your code vulnerable to SQL injection: Itโ€™s one of the oldest tricks in the hacker playbookโ€”SQL injection, which involves taking advantage of user input fields to gain direct access to a SQL database. In Rails, this vulnerability is found where user input is required (for instance, typing in a search field) to query data from a database. The traditional approach to handling a query for a username would look something like this:

user.find_by(name: params [:name])

This approach is vulnerable to SQL injection. Fortunately, in Rails we have Active Record dynamic attribute-based finders, which work as parameterized queries that can properly handle the passed argument, avoiding SQL injection.

user.find_by_name(name)

Besides using dynamic finders, it helps to only accept and construct values from external inputs such as search queries and forms. Never construct SQL commands like INSERT and DELETE, and donโ€™t send untrusted inputs to methods in the Active Record library that accept raw SQL queries, table names, or columns.

Tips and best practices

Take advantage of the Ruby developer community

Ruby may not be the most popular back-end scripting language, but those who use it love it. Ruby was created with programmer happiness in mind, something that is readily apparent when you look at Rubyโ€™s huge library of gemsโ€”ready-to-use solutions for common software development problems. If you need to rapidly prototype a project, you can virtually assemble an app from gems and boilerplate code in a snap.

Use symbols instead of strings in hashes

Ruby has a special data type called a symbol for storing the name of a variable that does not have to be changed. Symbols are prefixed with a colon denoted like so, :symbol. Unlike strings, which are mutable, symbols are immutable and take up only one spot in memory.

Immutability is perfect for hashes because you donโ€™t want your hash keys to change. Hashes are similar to arrays, except they can use any object as an index.

shopping_list = { :cinnamon => 1, :butter=> 2, :soda => 6}

Symbols are also more space efficient than strings, as setting multiple variables equal to the same symbol will access the same spot in memory.

Test your code often

Test-driven development famously takes a test-first and code-later approach to software development that looks something like this:

  • Red: write a test for a software feature that fails
  • Green: write the minimum code needed to pass the test
  • Refactor: rewrite your passing code to best practices

Unless you already practice TDD, it may seem difficult to see regular software testing as anything more than a necessary evil to catch as many bugs as you can before you push to production.

Thankfully, Ruby tries to make TDD easier by giving you everything you need to practice it within its standard library: minitest/unit and test/unit. Between these two testing frameworks you should be able to get into the habit of writing safer code by regularly creating unit tests. Once you get comfortable writing unit tests, practicing TDD in its entirety isnโ€™t so daunting.