Is it necessary to force_ssl? Or should the SSL terminate at the load balancer?

Question

On AWS OpsWorks. I'm using an ELB, which has my CA's SSL certificate.

The first point of access is always the load balancer (ELB). The ELB directs traffic to the instances. The instances each have a copy of the Rails app, Unicorn, etc.

One thing to note. The instances behind the ELB cannot be accessed directly.

At this point, do I need to force_ssl in Rails? I hear it's common enough to terminate SSL at the border (ELB).

As far as I've read, force_ssl gives the following:

1. Automatic redirect traffic from http to https.
2. Flagging cookies as secure and some added protection (ie against MITM attacks).

http://api.rubyonrails.org/classes/ActionController/ForceSSL/ClassMethods.html only indicates http to https redirection.

What does force_ssl do in Rails? second answer suggests that force_ssl does more than redirection.

If I decide not to use force_ssl , I can manage redirects by writing Nginx definitions.

Given the scenario, it feel like forcing SSL via Rails is obsolete, since the SSL negotiation is already happening in the ELB. Is it still necessary to force_ssl ? Are there any added benefits?

Answer 1

if you're terminating SSL at the ELB level you don't want it. (you want to take http traffic and not be redirected).

bear in mind that in this case the traffic between the ELB and your backend instances will be over HTTP (ie not encrypted). this is fine for most cases.