Rails 3: Make sure the user uses https

Question

I have a Rails 3 app running on Heroku and I also have a SSL installed and working. However, my users can still access the site without the https. How do I make sure that all urls are accessed using https?

Thanks

Edit:

I've tried adding this to application_controller.rb

 before_filter :redirect_to_ssl

  def redirect_to_ssl
      redirect_to url_for params.merge({:protocol => 'https://'})
  end

But I receive a Error 310 (net::ERR_TOO_MANY_REDIRECTS) error.

possible duplicate of Force SSL using ssl_requirement in Rails app — Simone Carletti
– Simone Carletti, Commented Feb 21, 2011 at 11:15
You should check before calling redirect. This is clearly a infinite redirect as you are redirecting always. in filter redirect_to_ssl you should first check if its not https. right?. Above content have a cleaner solution. — Zimbabao
– Zimbabao, Commented Feb 21, 2011 at 11:42
When I try to use ForceSSL solution, it crashes the app on Heroku. — donald
– donald, Commented Feb 21, 2011 at 12:06
@Zimbabao's comment is correct. You're ALWAYS redirecting to https, even when you're already on https! — Emil Ahlbäck
– Emil Ahlbäck, Commented Feb 27, 2014 at 13:51

user693960 · Accepted Answer · 2011-04-06 00:41:10Z

7

you may need to check if you are already using ssl... this works for us.

before_filter :redirect_to_ssl
def redirect_to_ssl
    redirect_to :protocol => "https://" unless (request.ssl?)
end

answered Apr 6, 2011 at 0:41

user693960

1411 silver badge2 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Yosep Kim · Accepted Answer · 2014-03-22 11:31:55Z

6

There is a configuration setting you can use in config/production.rb or application.rb for your production environment.

# Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
# config.force_ssl = true

This served me well on my Rails app without writing extra code.

answered Mar 22, 2014 at 11:31

Yosep Kim

2,96125 silver badges23 bronze badges

Comments

Community · Accepted Answer · 2017-05-23 12:09:11Z

5

Here's an answer I posted to a similar question.

Otherwise, you can use Rack::SSL.

edited May 23, 2017 at 12:09

CommunityBot

11 silver badge

answered Feb 21, 2011 at 11:15

Simone Carletti

177k50 gold badges371 silver badges370 bronze badges

2 Comments

donald Over a year ago

I tried Rack:SSL and worked. However, I want to limit the URL that is redirected. for example: I have myapp.com without certificate and myapp.heroku.com with certificate. I want to redirect to SSL only when it is myapp.heroku.com. thanks

Simone Carletti Over a year ago

Rack::SSL has an :exclude option. You'll find it reading the middleware code. It accepts a lambda and if the lambda returns true, Rack::SSL will be skipped.

Collectives™ on Stack Overflow

Rails 3: Make sure the user uses https

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related