SSL with Rails

http://collectiveidea.com/blog/archives/2010/11/29/ssl-with-rails/

by danielmorrison • 16 years ago

65 22 16 years ago

JonnieCache3• 16 years ago

Interesting. I didn't know it was this easy with rack.

Am I right in thinking that if third party embeds/widgets dont answer at an https url, I am stuck with mixed content warnings?

Twisol2• 16 years ago

You could proxy the request through a back-end server that does support HTTPS.

JonnieCache3• 16 years ago

Could I write a tiny one in rack and mount that in front of the rails stack using the new router in ActionDispatch 3? Hmmm...

patio114• 16 years ago

A word of caution: it is very easy for naive attempts to do this to end up creating an open proxy. You don't want that.

danielmorrison• 16 years ago

Most 3rd party stuff is good and supports SSL. YouTube is the giant exception. Annoying.

patio114• 16 years ago

Thanks, yoinking this for Appointment Reminder.

In the spirit of creating wealth through exchange:

https://gist.github.com/721114

A frequent problem I have is using CSS files which include http:// linked background images, which will pass through every test with flying colors and then trigger prominent mixed-content security warnings in a browser I very seldom use. Slap this code in your initializers directory and you never have to worry about it again.

Just write your stylesheet_link_tag as normal, and then include :cache => request.ssl? ? "foo-secure" : "foo-standard"

Bonus: the included code also minimizes CSS and JS files in production, saving you page load time.

stephencelis• 16 years ago

Couldn't you just use protocol-relative URLs in your CSS files? (Or for that matter, absolute paths.)

hboon• 16 years ago

The minimizing is good, but doesn't using a path like //example.com/my-image.jpg instead of http://example.com/my-image.jpg fix the issue with http/https?

patio114• 16 years ago

That works if you can enforce that 100% of the time, against all CSS loaded by your site. The first time you forget it in e.g. a lightbox script you add to get used on a landing page whose implementation you didn't even glance at, your registration page will break. This has cost me thousands of dollars before, so I enforce assumptions like "there are no http:// urls in my CSS files" in code.

kyleslattery• 16 years ago

If you want a super simple way to require SSL in Rails 3, you can use route constraints: http://kyleslattery.com/entries/requiring-ssl-using-route-co...

stretchwithme• 16 years ago

I usually just use whatever is the most robust, stable open source choice for Rails app. Sphinx for search, etc. and Apache for the web server. Doing SSL is well documented and pretty much everything is possible and documented and supported by webmin too. I have a virtual host sending all non-ssl requests to ssl.

It doesn't have to be Ruby, especially if I won't be programming for it anyway.

Erwin• 16 years ago

This part was new to me: http://en.wikipedia.org/wiki/Strict_Transport_Security

This is an additional (draft status) header that tells the user agent to always (or up to X seconds in the future) use HTTPS for that site and it seems, to disallow any connections using bad certificates.

Currently only Chrome and latest dev version of Firefox seem to support it. Chrome apparently has a pre-loaded list of always-https domains, like www.paypal.com -- who are also the people behind this draft proposal.

tomjen3• 16 years ago

The one problem nobody talks about is that browsers won't cache content served over ssl, which means your website will be a lot slower to your users. That will directly costs you money.

daveungerer• 16 years ago

Firefox does cache content - I just ran Firebug to confirm. I can only assume from how fast my site works in other browsers that the same applies to them. What browsers are you referring to?

speleding• 16 years ago

Wow, that tip about using protocol relative URLs is going to clean up so much code for me.

For those who missed it, apparently this works across browser to avoid mixed content warnings:

wglb• 16 years ago

Ach! Accidental downvote.

Thanks for the detail.

SSL with Rails

Related Stories