Force_ssl in production.rb - how to override only http in the controller

Question

in my production.rb, i

config.force_ssl = true 

and would like to provide exceptions. It seems like this should work (can't find how to get back to 3.2.19):

 class ApiItemsController < ApplicationController force_ssl except: :get_item_test 

but this is not so. I saw Rails 3.2 force_ssl, with the exception of the landing page , but I really don't want to add gems for such a trivial thing. How do I make this work?

---

change 1

Answer 1

You cannot create custom exceptions using config.force_ssl = true because Rails uses rack-ssl , which sets the Strict-Transport-Security header . You probably don't want to disable this for landing pages, since Google now uses this as a ranking signal .

Answer 2

@ brad-werth is absolutely correct that the HTS headers do this, which you probably don't want to do. But I still want to do it like this, here is what I found out:

In Rails 5 (according to ActionDispatch :: SSL docs ):

 config.ssl_options = { redirect: { exclude: -> request { request.path =~ /health_check/ } } } 

In Rails 4 (and some versions of Rails 3) you need to use a separate stone. Or, if it is possible to do what you need in the middleware, you can try something like this:

 # config/environments/production.rb config.middleware.insert_before 'ActionDispatch::SSL', 'HealthCheck' # app/middleware/health_check.rb class HealthCheck def initialize(app) @app = app end def call(env) if env['REQUEST_PATH'] == '/health_check' return [200, {}, []] else @app.call(env) end end end 

Some versions of Rails 3 reportedly support something like this :

 config.ssl_options = { exclude: proc { |env| env['PATH_INFO'].start_with?('/health_check')} } 

To answer the question, the config.force_ssl parameter in the environment is different from using force_ssl in the controller and it may not be that difficult.