Ruby on Rails

History

David Heinemeier Hansson extracted Ruby on Rails from his work on the project management tool Basecamp at the web application company 37signals. Hansson first released Rails as open source in July 2004, but did not share commit rights to the project until February 2005. In August 2006, the framework reached a milestone when Apple announced that it would ship Ruby on Rails with Mac OS X v10.5 "Leopard",{{cite web |access-date = 2008-06-08 |archive-date = 13 August 2006 |archive-url = https://web.archive.org/web/20060813093250/http://weblog.rubyonrails.org/2006/8/7/ruby-on-rails-will-ship-with-os-x-10-5-leopard |url-status = live

Rails version 2.3 was released on 15 March 2009, with major new developments in templates, engines, Rack and nested model forms. Templates enable the developer to generate a skeleton application with custom gems and configurations. Engines give developers the ability to reuse application pieces complete with routes, view paths and models. The Rack web server interface and Metal allow one to write optimized pieces of code that route around Action Controller.{{cite web | access-date = 22 March 2009 | archive-date = 21 March 2009 | archive-url = https://web.archive.org/web/20090321021909/http://weblog.rubyonrails.org/2009/3/16/rails-2-3-templates-engines-rack-metal-much-more | url-status = live

On 23 December 2008, Merb, another web application framework, was launched, and Ruby on Rails announced it would work with the Merb project to bring "the best ideas of Merb" into Rails 3, ending the "unnecessary duplication" across both communities. Merb was merged with Rails as part of the Rails 3.0 release.

Rails 3.1 was released on 31 August 2011, featuring Reversible Database Migrations, Asset Pipeline, Streaming, jQuery as default JavaScript library and newly introduced CoffeeScript and Sass into the stack.

Rails 3.2 was released on 20 January 2012 with a faster development mode and routing engine (also known as Journey engine), Automatic Query Explain and Tagged Logging. Rails 3.2.x is the last version that supports Ruby 1.8.7. Rails 3.2.12 supports Ruby 2.0.

Rails 4.0 was released on 25 June 2013, introducing Russian Doll Caching, Turbolinks, and Live Streaming as well as making Active Resource, Active Record Observer and other components optional by splitting them as gems.

Rails 4.1 was released on 8 April 2014, introducing Spring, Variants, Enums, Mailer previews, and secrets.yml.

Rails 4.2 was released on 19 December 2014, introducing Active Job, asynchronous emails, Adequate Record, Web Console, and foreign keys.

Rails 5.0 was released on 30 June 2016, introducing Action Cable, API mode, and Turbolinks 5.

Rails 5.0.0.1 was released on 10 August 2016, with Exclusive use of rails CLI over Rake and support for Ruby version 2.2.2 and above.

Rails 5.1 was released on 27 April 2017, introducing JavaScript integration changes (management of JavaScript dependencies from NPM via Yarn, optional compilation of JavaScript using Webpack, and a rewrite of Rails UJS to use vanilla JavaScript instead of depending on jQuery), system tests using Capybara, encrypted secrets, parameterized mailers, direct & resolved routes, and a unified form_with helper replacing the form_tag/form_for helpers.

Rails 5.2 was released on 9 April 2018, introducing new features that include ActiveStorage, built-in Redis Cache Store, updated Rails Credentials and a new DSL that allows for configuring a Content Security Policy for an application.

Rails 5.2.2 was released on 4 December 2018, introducing numerous bug fixes and several logic improvements.

Rails 6.0 was released on 16 August 2019, making Webpack default, adding mailbox routing, a default online rich-text editor, parallel testing, multiple database support, mailer routing and a new autoloader.

Rails 6.1 was released on 9 December 2020, adding per-database connection switching, horizontal database sharding, eager loading of all associations, Delegated Types as an alternative to single-table inheritance, asynchronous deletion of associations, error objects, and other improvements and bug fixes.

Rails 7.0 was released on 15 December 2021, replacing Node.js and Webpack with import maps for JavaScript management by default, replacing Turbolinks with a combination of Turbo and Stimulus, adding at-work encryption into Active Record, using Zeitwerk exclusively for code loading, and more.

Rails 7.1 was released on 5 October 2023, Dockerfiles support using Kamal in order to deploy your application, authentication improvements, and now including support for bun.

Ruby on Rails 8.0.0 was released on 8 November 2024. This major release introduces fundamental shifts in Rails development, enabling individual developers to host and manage their applications independently without the need for a Platform-as-a-service. The update focuses on empowering single developers to handle all aspects of application deployment and management seamlessly.

Ruby on Rails 8.1.0 was released on October 24, 2025. Major features include Active Job Continuations, Structured Event Reporting, Local CI, and Markdown rendering.

A revised maintenance policy was instituted in October 2024.

Technical overview

Ruby on Rails evolves radically from release to release exploring the use of new technologies and adopting new standards on the Internet. Some features are very stable in Ruby on Rails while some are replaced in favour of new techniques.

Model-view-controller pattern

The model–view–controller (MVC) pattern is the fundamental structure to organize application programming.

In a default configuration, a model in the Ruby on Rails framework maps to a table in a database and to a Ruby file. For example, a model class User will usually be defined in the file 'user.rb' in the app/models directory, and linked to the table 'users' in the database. While developers are free to ignore this convention and choose differing names for their models, files, and database table, this is not common practice and is usually discouraged in accordance with the "convention-over-configuration" philosophy.

A controller is a server-side component of Rails that responds to external requests from the web server to the application, by determining which view file to render. The controller may also have to query one or more models for information and pass these on to the view. For example, in an airline reservation system, a controller implementing a flight-search function would need to query a model representing individual flights to find flights matching the search, and might also need to query models representing airports and airlines to find related secondary data. The controller might then pass some subset of the flight data to the corresponding view, which would contain a mixture of static HTML and logic that use the flight data to create an HTML document containing a table with one row per flight. A controller may provide one or more actions. In Ruby on Rails, an action is typically a basic unit that describes how to respond to a specific external web-browser request. Also, note that the controller/action will be accessible for external web requests only if a corresponding route is mapped to it. Rails encourages developers to use RESTful routes, which include actions such as create, new, edit, update, destroy, show, and index. These mappings of incoming requests/routes to controller actions can be easily set up in the routes.rb configuration file.

A view in the default configuration of Rails is an erb file, which is evaluated and converted to HTML at run-time. Alternatively, many other templating systems can be used for views.

Ruby on Rails includes tools that make common development tasks easier "out-of-the-box", such as scaffolding that can automatically construct some of the models and views needed for a basic website. Also included are WEBrick, a simple Ruby web server that is distributed with Ruby, and Rake, a build system, distributed as a gem. Together with Ruby on Rails, these tools provide a basic development environment.

HTTP servers

Ruby on Rails is most commonly not connected to the Internet directly, but through some front-end web server. Mongrel was generally preferred over WEBrick in the early days, but it can also run on Lighttpd, Apache, Cherokee, Hiawatha, Nginx (either as a module – Phusion Passenger for example – or via CGI, FastCGI or mod ruby), and many others. From 2008 onward, Passenger replaced Mongrel as the most-used web server for Ruby on Rails. Ruby is also supported natively on IBM i.

JavaScript

Ruby on Rails is also noteworthy for its extensive use of the JavaScript libraries Prototype and Script.aculo.us for scripting Ajax actions. Ruby on Rails 3.0 separates the markup of the page (which defines the structure of the page) from scripting (which determines functionality or logic of the page). As of version 7.0, new Ruby on Rails applications come with the Hotwire family of JavaScript libraries installed by default.

Web services

Since version 2.0, Ruby on Rails offers both HTML and XML as standard output formats. The latter is the facility for RESTful web services.

CSS

Rails 3.1 introduced Sass as standard CSS templating.

Template

By default, the server uses Embedded Ruby in the HTML views, with files having an html.erb extension. Rails supports swapping-in alternative templating languages, such as HAML and Mustache.

Ruby versions

Ruby on Rails 3.0 has been designed to work with Ruby 1.8.7, Ruby 1.9.2, and JRuby 1.5.2+; earlier versions are not supported.

Ruby on Rails 3.2 is the last series of releases that support Ruby 1.8.7.

Framework structure

Ruby on Rails is separated into various packages, namely ActiveRecord (an object-relational mapping system for database access), Action Pack, Active Support and Action Mailer. Prior to version 2.0, Ruby on Rails also included the Action Web Service package that is now replaced by Active Resource. Apart from standard packages, developers can make plugins to extend existing packages. Earlier Rails supported plugins within their own custom framework; version 3.2 deprecates these in favor of standard Ruby "gems".

Deployment

Ruby on Rails is often installed using RubyGems, a package manager which is included with current versions of Ruby. Many free Unix-like systems also support installation of Ruby on Rails and its dependencies through their native package management system.

Ruby on Rails is typically deployed with a database server such as MySQL or PostgreSQL, and a web server such as Apache running the Phusion Passenger module.

Philosophy and design

Ruby on Rails is intended to emphasize Convention over Configuration (CoC), and the Don't Repeat Yourself (DRY) principle.

The Rails Doctrine (rubyonrails.org/doctrine) is an enduring enabler that guides the philosophy, design, and implementation of the Ruby on Rails framework.

"Convention over Configuration" means a developer only needs to specify unconventional aspects of the application. For example, if there is a class Sale in the model, the corresponding table in the database is called sales by default. It is only if one deviates from this convention, such as calling the table "products sold", that the developer needs to write code regarding these names. Generally, Ruby on Rails conventions lead to less code and less repetition.

"Don't repeat yourself" means that information is located in a single, unambiguous place. For example, using the ActiveRecord module of Rails, the developer does not need to specify database column names in class definitions. Instead, Ruby on Rails can retrieve this information from the database based on the class name.

"Fat models, skinny controllers" means that most of the application logic should be placed within the model while leaving the controller as light as possible.

HTML Over The Wire (Hotwire), Conceptual compression, and robust security mark Rails 7.0's approach to the One person framework.

Trademarks

In March 2007, David Heinemeier Hansson applied to register three Ruby on Rails-related trademarks with the USPTO. These applications concern the phrase "RUBY ON RAILS", the word "RAILS", and the official Rails logo. In the summer of 2007, Hansson denied the publisher Apress permission to use the Ruby on Rails logo on the cover of a new Ruby on Rails book written by some authoritative community members. The episode gave rise to a polite protest in the Ruby on Rails community. In response to this criticism, Hansson replied:

The trademark of the logo was cancelled on 25 October 2019.

Reception

Scalability

In earlier days, Rails running on Matz's Ruby Interpreter (the de facto reference interpreter for Ruby) had been criticized for issues with scalability. These critiques often mentioned various Twitter outages in 2007 and 2008, which spurred Twitter's partial transition to Scala (which runs on the Java Virtual Machine) for their queueing system and other middleware.{{cite web |name-list-style = amp |access-date = 2009-07-18 |archive-date = 19 June 2009 |archive-url = https://web.archive.org/web/20090619164149/http://www.artima.com/scalazine/articles/twitter_on_scala.html |url-status = live |access-date = 2009-07-18 |archive-date = 12 August 2017 |archive-url = https://web.archive.org/web/20170812232515/http://www.theregister.co.uk/2009/04/01/twitter_on_scala/ |url-status = live |access-date = 2009-09-29 |archive-date = 27 September 2009 |archive-url = https://web.archive.org/web/20090927063142/http://blog.evanweaver.com/articles/2009/09/24/ree/ |url-status = live | access-date = 6 June 2014}} On the other hand, many Rails business application developers relied on system architecture design, including choices of database engine, cache configuration, and servers, to tackle scalability issues. The original author of Rails, David Heinemeier Hansson, criticized Twitter, saying that their problems scaling were the consequences of their own poor architectural decisions and not the fault of Rails. According to Hansson, blaming Rails for their troubles while making no contributions to the framework is ungrateful and unjust.

In 2011, Gartner Research noted that despite criticisms and comparisons to Java, many high-profile consumer web firms are using Ruby on Rails to build scalable web applications. Some of the largest sites running Ruby on Rails include Airbnb, Cookpad, GitHub, GitLab, Scribd, Shopify, and Basecamp. As of January 2016, it is estimated that more than 1.2 million web sites are running Ruby on Rails.

Security

In March 2012, security researcher Egor Homakov discovered a mass assignment vulnerability that allowed certain Rails applications to be remotely exploited, and demonstrated it by non-maliciously hacking GitHub after his earlier attempts at responsible disclosure were dismissed.

On 24 September 2013, a session cookie persistence security flaw was reported in Ruby on Rails. In a default configuration, the entire session hash is stored within a session cookie known as CookieStore, allowing any authenticated session possessing the session cookie to log in as the target user at any time in the future. As a workaround, administrators are advised to configure cookies to be stored on the server using mechanisms such as ActiveRecordStore.

Researchers Daniel Jackson and Joseph Near developed a data debugger they called "Space" that can analyze the data access of a Rails program and determine if the program properly adheres to rules regarding access restrictions. On 15 April 2016, Near reported that an analysis of 50 popular Web applications using Space uncovered 23 previously unknown security flaws.

Notes

References

Bibliography

• {{Cite book |url-access = registration
• {{Cite book |url-access = registration
• {{Cite book |url-access = registration
• {{Cite book |access-date = 12 July 2009 |archive-date = 27 June 2009 |archive-url = https://web.archive.org/web/20090627153614/http://oreilly.com/catalog/9780596101329/ |url-status = live
• {{Cite book |access-date = 12 July 2009 |archive-date = 23 April 2012 |archive-url = https://web.archive.org/web/20120423022010/http://www.wrox.com/WileyCDA/WroxTitle/Beginning-Ruby-on-Rails.productCd-0470069155.html |url-status = dead
• {{Cite book |access-date = 12 July 2009 |archive-date = 17 September 2010 |archive-url = https://web.archive.org/web/20100917191031/http://apress.com/book/view/9781590597361 |url-status = dead
• {{Cite book |url-access = registration

References

1. "Getting Started with Rails: What Is Rails?".
2. "Django vs Ruby on Rails – The Choice for Mobile App Development".
3. Conrad, Adam. (3 August 2021). "Episode 471: Jason Meller on Choosing the Right Tech Stack for a Greenfield Project". [[IEEE]].
4. "Breaking the Monolith at Twitch: Part One".
5. Grimmer, Lenz−−. (February 2006). "Interview with David Heinemeier Hansson from Ruby on Rails". [[MySQL AB]].
6. (2008-12-27). "The day Merb joined Rails".
7. "Ruby on Rails 3.0 Release Notes — Ruby on Rails Guides".
8. (2010-02-10). "Ruby on Rails 3.0 goes modular". sdtimes.com.
9. (2012-09-01). "Ruby on Rails 3.1 Release Notes".
10. (2012-09-01). "Ruby on Rails 3.2 Release Notes".
11. (2012-09-01). "Rails/master is now 4.0.0.beta".
12. [https://github.com/rails/rails/pull/9406 Rails 3.2.x is now compatible with Ruby 2.0.0 by sikachu · Pull Request #9406 · rails/rails · GitHub] {{Webarchive. link. (29 July 2017 . Github.com. Retrieved on 2014-05-30.)
13. (2013-06-25). "Rails 4.0: Final version released!".
14. (8 April 2014). "Rails 4.1.0: Spring, Variants, Enums, Mailer previews, secrets.yml".
15. (19 December 2014). "Rails 4.2: Active Job, Asynchronous Mails, Adequate Record, Web Console, Foreign Keys".
16. (30 June 2016). "Rails 5.0: Action Cable, API mode, and so much more".
17. (27 April 2017). "Rails 5.1: Loving JavaScript, System Tests, Encrypted Secrets, and more".
18. (9 April 2018). "Rails 5.2.0 FINAL: Active Storage, Redis Cache Store, HTTP/2 Early Hints, CSP, Credentials".
19. rafaelfranca. (2018-12-04). "Rails 5.2.2 has been released!".
20. dhh. (2019-08-19). "Rails 6.0: Action Mailbox, Action Text, Multiple DBs, Parallel Testing, Webpacker by default, and Zeitwerk".
21. eileencodes. (2020-12-09). "Rails 6.1: Horizontal Sharding, Multi-DB Improvements, Strict Loading, Destroy Associations in Background, Error Objects, and more!".
22. dhh. (2021-12-15). "Rails 7.0: Fulfilling a vision".
23. "Rails 7.1: Dockerfiles, BYO Authentication, More Async Queries, and more!".
24. (26 September 2024). "Rails 8.0 Released: Empowering Developers to Self-Host".
25. (24 October 2025). "Rails 8.1: Job continuations, structured events, local CI".
26. "Ruby/Rails Compatibility Matrix".
27. "Upgrading Ruby on Rails".
28. [http://weblog.rubyonrails.org/2005/12/13/rails-1-0-party-like-its-one-oh-oh/ "Rails 1.0: Party like it's one oh oh!"] {{Webarchive. link. (17 December 2015 . ''weblog.rubyonrails.org''. Retrieved 9 June 2010.)
29. [http://weblog.rubyonrails.org/2007/1/19/rails-1-2-rest-admiration-http-lovefest-and-utf-8-celebrations "Rails 1.2: REST admiration, HTTP lovefest, and UTF-8 celebrations"] {{webarchive. link. (2012-11-02 . ''weblog.rubyonrails.org''. Retrieved 9 June 2010.)
30. [http://weblog.rubyonrails.org/2007/12/7/rails-2-0-it-s-done "Rails 2.0: It's done!"] {{Webarchive. link. (28 May 2010 . ''weblog.rubyonrails.org''. Retrieved 9 June 2010.)
31. [http://weblog.rubyonrails.org/2008/5/31/rails-2-1-time-zones-dirty-caching-gem-dependencies-caching-etc Rails 2.1: Time zones, dirty, caching, gem dependencies, caching, etc] {{webarchive. link. (2012-11-02 . ''weblog.rubyonrails.org''. Retrieved 9 June 2010.)
32. [http://weblog.rubyonrails.org/2008/11/21/rails-2-2-i18n-http-validators-thread-safety-jruby-1-9-compatibility-docs "Rails 2.2: i18n, HTTP validators, thread safety, JRuby/1.9 compatibility, docs"] {{Webarchive. link. (2 December 2008 . ''weblog.rubyonrails.org''. Retrieved 9 June 2010.)
33. [http://weblog.rubyonrails.org/2009/3/16/rails-2-3-templates-engines-rack-metal-much-more "Rails 2.3: Templates, Engines, Rack, Metal, much more!"] {{Webarchive. link. (21 March 2009 . ''weblog.rubyonrails.org''. Retrieved 9 June 2010.)
34. [http://weblog.rubyonrails.org/2010/8/29/rails-3-0-it-s-done "Rails 3.0: It's ready!"] {{Webarchive. link. (31 August 2010 . ''weblog.rubyonrails.org''. Retrieved 30 August 2010.)
35. "bumping to 3.1.0".
36. "Preparing for 3.2.0 release".
37. "Rails 4 in 30'".
38. "Rails 7.1: Dockerfiles, BYO Authentication, More Async Queries, and more!".
39. "Development of Rails 7.2 starts now".
40. "Rails 8.0: No PaaS Required".
41. "Rails 8.1: Job continuations, structured events, local CI".
42. "Maintenance policy".
43. "New Rails maintenance policy and end of maintenance announcements".
44. "The Rails Doctrine".
45. Sean Lynch. (2007-12-15). "fairleads: Rails 2.0 and Scaffolding Step by Step".
46. "Ruby on Rails: Deploy".
47. Maxcer, Chris. "PowerRuby Brings Enterprise Ruby on Rails Support to IBM i". iPro Developer.
48. Js_Escape_Map. "ActionView::Helpers::JavaScriptHelper".
49. (29 August 2010). "Rails 3.0: It's ready!".
50. (2012-09-01). "Rails 3.2.0.rc2 has been released!".
51. "Ruby on Rails: Download".
52. "Getting Started with Rails".
53. David Heinemeier Hansson [https://world.hey.com/dhh/the-time-is-right-for-hotwire-ecdb9b33 (7 Dec 2021) The time is right for Hotwire] {{Webarchive. link. (20 December 2021)
54. David Heinemeier Hansson [https://world.hey.com/dhh/rails-7-will-have-three-great-answers-to-javascript-in-2021-8d68191b (6 September 2021) Rails 7 will have three great answers to JavaScript in 2021+] {{Webarchive. link. (20 December 2021)
55. David Heinemeier Hansson [https://m.signalvnoise.com/conceptual-compression-means-beginners-dont-need-to-know-sql-hallelujah/ (19 April 2018) Conceptual compression means beginners don’t need to know SQL — hallelujah!] {{Webarchive. link. (20 December 2021)
56. link. (20 December 2021 Conceptual compression)
57. David Heinemeier Hansson [https://www.hey.com/security/ (31 Aug 2020) Serious security] {{Webarchive. link. (26 December 2021)
58. David Heinemeier Hansson, creator of Ruby on Rails and hey.com [https://developers.slashdot.org/story/21/12/19/2043226/ruby-on-rails-creator-touts-70-as-one-person-framework-the-way-it-used-to-be (19 Dec 2021) Ruby on Rails Creator Touts 7.0 as One-Person Framework, 'The Way It Used To Be'] {{Webarchive. link. (20 December 2021)
59. ""Ruby on Rails" Trademark Status". [[USPTO]].
60. ""Rails" Trademark Status". [[USPTO]].
61. "Rails Logo Trademark Status". [[USPTO]].
62. Forde, Pete. (2007-07-23). "Beginning Rails: From Novice to Professional".
63. Cooper, Peter. (2007-07-24). "David Heinemeier Hansson says No to Use of Rails Logo".
64. (2007-03-29). "5 Question Interview with Twitter Developer Alex Payne". radicalbehavior.com.
65. "I won't let you pay me for my open source".
66. "Why we're sticking with Ruby on Rails".
67. "Here's Why Ruby On Rails Is Hot". Business Insider.
68. "Ruby on Rails Usage Statistics".
69. "Ruby on Rails Token Usage Statistics".
70. Protalinski, Emil. "How GitHub handled getting hacked".
71. Brook, Chris. (2013-09-25). "Security Issue in Ruby on Rails Could Expose Cookies". The Kaspersky Lab Security News Service.
72. (15 April 2016). "Patching up Web applications".