rails 3 - Securing an app with SSL

Question

I have a rails 3 app hosted on heroku which contains sensitive data which is why i want to implement SSL. The info I learned from google searching doesn't exactly match my use case as I want to SSL the entire site. I'd like your help understanding the following.

Is there a simple way to force all app requests to use SSL? I want the landing page to even have SSL as the landing page has a sign in form. It seems like it'd be a lot simpler to SSL everything than select SSL on a per page basis. That being said, do I need a gem for this?

Thank you

This article should help you.

Shreyas
– Shreyas

2010-12-01 05:57:19 +00:00
Commented Dec 1, 2010 at 5:57 — Shreyas
– Shreyas, Commented Dec 1, 2010 at 5:57

yfeldblum · Accepted Answer · 2010-12-01 05:45:31Z

2

Look for a Rack middleware that accomplishes this.

https://github.com/tobmatth/rack-ssl-enforcer

answered Dec 1, 2010 at 5:45

yfeldblum

65.5k12 gold badges132 silver badges169 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

AnApprentice Over a year ago

Thanks, what's the recommendation for dev... use https on development? Isthat even possible?

Doon Over a year ago

if you run your dev under apache/nginx or the like yes you can run under ssl on dev. Some people prefer to run dev and production the same (ssl vs none). some don't. I don't run ssl on dev, but do on integration / qa servers..

B Seven · Accepted Answer · 2011-08-19 17:33:04Z

I found this post today which is updated and looks like a good solution: http://www.simonecarletti.com/blog/2011/05/configuring-rails-3-https-ssl/

I am using SSL Enforcer with Heroku and it works great. However, I had a lot of trouble setting up SSL on my dev machine (Ubuntu 11.04).

First, Webrick did not work with SSL, so I found a hack which worked for a while. But then I had a weird javascript and Google Visualization API problem with it.

Now I installed Thin (which was easy), but it is not working with SSL Enforcer.

If you have the time to install and configure Apache, SSL will work. But I don't think Heroku uses Apache, so that's not so good...

I can see why people don't want to figure out how to run SSL on their local machine...maybe it's not worth it if you have a staging or QA server that does run SSL.

Collectives™ on Stack Overflow

rails 3 - Securing an app with SSL

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related