Rails force HTTPS for your application
Aug 22, 2014 - 1 minutesThis is your setup:
- Nginx redirecting HTTP to HTTPS
- Unicorn/puma/(etc) being reverse proxied to via nginx
What you may not realize:
When you’re submitting a form and using the redirect_to
or respond_with @object, location: []
methods rails may not pick up that you want to use HTTPS as the protocol, adding this to your application_controller.rb
ensures every URL generated by rails will go to a secure protocol:
1def default_url_options(options={})
2 options.merge!(protocol: 'https') unless Rails.env.development? || Rails.env.test?
3 options
4end
I ran into issues with rails redirecting to plain HTTP when doing some uploading utilizing iframes (and Chrome rightfully blocking the redirect back to http). Hope this helps someone else! No need to use any special gems.
Note: This only applies if you want all actions to be HTTPS though.