在Rails中将参数传递给iframe不起作用

Question

I'm a rails noob so I know I'm probably totally missing something here. I'm trying to pass a url to an iframe through my products controller.

This is my setup.

Products Controller

    def open_url
        @url = params[:url]
    end

index.html.erb

<%= link_to "More Info", open_path(url: "http://www.ceratoboutique.com" + product.destination_url) %>

open_url.html.erb

<iframe src= "<%= @url %>" style="border: 0; position:fixed; top:0; left:0; right:0; bottom:0; width:100%; height:100%" /> 

routes.rb

get '/open' => 'products#open_url', via: 'get'

I,ve checked out these two questions

Rails 4 - Passing Params via link_to?

Opening a Link in a New Window within an iFrame

but i'm still lost, the url is passed to the browser but it does not seem to pass to the @url variable in my controller.

Debug Dump

!ruby/hash:ActionController::Parameters

url: http://www.ceratoboutique.com/collections/tops/products/combo-blouse

controller: products

action: open_url

Answer 1

I decided to stick to rails conventions and make it a restful link. I still do not know why the original implementations did not work, but it worked using the show method in the controller.

Controller

def show
    @url = Product.find(params[:id])
end

index.html.erb

<%= link_to "More Info", product_path(product) %> 

show.html.erb

<iframe src= "<%= "http://www.ceratoboutique.com" + @product.destination_url %>" style="border: 0; position:fixed; top:0; left:0; right:0; bottom:0; width:100%; height:100%" /> 

****Edit Added More Info for including I-Frame ****

I ran into a lot of problems trying to get my iframe to work in chrome and on Heroku so I combined the process if anyone needs it ever. I first deployed to Heroku with full SSL running on my site, then realized that iframe did not work in chrome for sites that were not running SSL. I redeployed configuring force SSL to false, but heroku still forced my app to SSL. I realized that config.force_ssl = true enables Strict Transport Security header(HSTS) with max-age of one year, so I had to expire HSTS using the following.

Expire SSL in application controller

class ApplicationController < ActionController::Base
  before_filter :expire_hsts

  def expire_hsts
    response.headers["Strict-Transport-Security"] = 'max-age=0'
  end 

In Production.rb

config.force_ssl = false 

Then to make sure the x-frame showed in chrome browsers I added the following.

enable x-frame in chrome

config.action_dispatch.default_headers = { 'X-Frame-Options' => 'ALLOWALL' }

You may want to run SSL on some of your pages, which can be done rather easily via the SSL enforcer gem linked below.

ssl-enforcer gem

https://github.com/tobmatth/rack-ssl-enforcer

Best of luck on navigating the ugliness that is the iFrame!