如何通过https从Heroku上托管的Rails应用程序访问Google云端硬盘文档内容？

Question

I have a Rails app ( https://github.com/ddelruss/loops ) which I have hosted on Heroku. It uses a Rails form to collect the user's Google id, password, and document id, which it uses to log in to Google drive, download the document contents, and render as a D3 visualization. All that works fine - test if you like (and trust the current security):

http://young-eyrie-4632.herokuapp.com/

You can use the publicly available demo document key: 0AtOGnLq8Mf_ydGtmMmI5UjhEUmlqQ0d6UHFVaWN2TWc

None of the user information is stored, as I want to keep the site as secure as possible. The flaw is that the site is currently accessed at http, which I understand to mean that the user credentials are sent from the web form to Heroku/Rails unencrypted.

So, I want to access the app through https, which Heroku supports through ssl piggybacking. And indeed the site loads with https:// and will render the visualization page. The problem is that the Google doc does not return any results. The login succeeds, no application error (according to heroku logs)...just with an empty result.

What can I do to get my app working through https, including getting results from the Google drive document? Note that I don't need both - if https works I'm fine disabling http access.

Thank you,

Damien

Answer 1

I ran your app with the demo document and the Hierarchy option with both http and https and from looking at the HTML, it appears that the content is present in both cases, but not displayed in the case of https. That is, I believe Google is returning the document properly.

I didn't do a complete comparison of the HTML generated in the two cases, but after a quick glance, it appears that the http://d3js.org/d3.v2.js /script node is not present in the case of https access as it is in the http case.

Hope this helps.

Pete

4/25/13 Update: Looking at my Console output on Chrome, I see the following error:

[blocked] The page at https://young-eyrie-4632.herokuapp.com/loops/nodes ran insecure content from http://mbostock.github.com/d3/d3.js .

and I confirmed that this script does not appear under Chrome's "Sources" tab, so I gather it's not getting loaded in the https case. I don't know if you can change this to an https reference or whether you're going to have to add it to your repository so that Rails loads it at startup. That still leaves the reference to http://d3js.org/d3.v2.js . I can't figure out where that's coming from.