在Rails中对HTTP请求强制使用SSL

Question

I'm working on a platform built with Ruby(v2.1.2) on Rails(v4.1.6) and we're trying to enforce SSL. How do I go about doing this?

So far, I have force_ssl

# application_controller.rb

force_ssl if: :ssl_configured?

def ssl_configured?
  return false if params[:controller] == 'high_voltage/pages'
  (Rails.env.development? || Rails.env.test?) ? false : true
end

Which seems to work because when I try to do http://www.somecoolsite.com , it then automatically becomes https://www.somecolesite.com .

However, if I try to submit a JSON post request to the API portion of our platform, and the URL is http:// , the post request is somehow returning the results of a get request instead. But when I change the URL to https:// , the post request works as expected. How would I go about fixing this so that if a client accidentally submits their request as http:// , it is rewritten to https:// ?

Thanks!

Answer 1

Have you looked at using config.force_ssl = true in your production environment config? This is far more all-encompassing, but can lead to other issues as well.