Rails: why does my server redirect http to https

Question

I have a rails application that I built on Heroku and I configured it to use SSL. Now I'm moving to AWS EC2, and I want the version of my application to work without SSL. After that I will add the SSL function later.

My stack is Puma + Nginx + PostgreSQL, and I work with Rails 4.2.4, Ruby 2.2.3 and Capistrano 3.4.0.

I remember in my application that I once inserted a row

config.force_ssl = true 

in config / environment / production.rb. I commented on this, expecting my application to return to working with http. But this is not so: even after commenting on this line, whenever I visit my EC2 IP address (52.35.82.113), the request is sent to port 80 (http) and redirected to port 443 (https).

This can be seen more clearly when I run curl -v http://localhost in my EC2 instance, which it returns:

 * Rebuilt URL to: http://localhost/ * Hostname was NOT found in DNS cache * Trying 127.0.0.1... * Connected to localhost (127.0.0.1) port 80 (#0) > GET / HTTP/1.1 > User-Agent: curl/7.35.0 > Host: localhost > Accept: */* > < HTTP/1.1 301 Moved Permanently * Server nginx/1.4.6 (Ubuntu) is not blacklisted < Server: nginx/1.4.6 (Ubuntu) < Date: Sat, 12 Dec 2015 12:22:56 GMT < Content-Type: text/html < Transfer-Encoding: chunked < Connection: keep-alive < Location: https://localhost/ < * Connection #0 to host localhost left intact 

I am not very experienced when it comes to this. At first I thought there was a problem with my Nginx configuration, in my previous question here I was asked that there was nothing wrong with my Nginx configuration and that the redirect was from Rails. I suspect this is because I don't see anything in Nginx that could provide a redirect, but if you think the problem might be there, you can see a lot of relevant code in the link above.

What else in Rails, besides the above force_ssl, can cause a redirect?

Thanks for all your help. Let me know if you have any questions or need more information!

Answer 1

This meaning suggests that this may be due to the HSTS header:

So, if you enabled force_ssl once, even if [if] you change the configuration value to false later, the browser that you used to open the application [r] still remembers this website (using the domain for identification) [ and] requires [you] use HTTPS and automatically redirect you to an HTTPS connection.

According to this page, you can delete HSTS entries by going to chrome://net-internals/#hsts in Chrome and about:permissions in Firefox and deleting ~/Library/Cookies/HSTS.plist in Safari.

Answer 2

In Rails, you can force the SSL site using the configuration file (for example, you do), or you can choose which endpoints will use SSL and use the force_ssl class force_ssl at the controller level.

Perhaps you used this method on your application_controller.rb or who ever controlled the root path and forgot about it. You can find an example of such a mechanism in Rails docs: http://api.rubyonrails.org/classes/ActionController/ForceSSL/ClassMethods.html

force_ssl (options = {}) Link Force a request to this particular controller or certain actions under the HTTPS protocol.

If you need to disable this for any reason (for example, development), then you can use the condition: if or: if.

 class AccountsController < ApplicationController force_ssl if: :ssl_configured? def ssl_configured? !Rails.env.development? end end 

Answer 3

I tried before to comment on this line on a production server and haven’t changed anything, so instead of commenting, just change true to false:

 config.force_ssl = false 

Answer 4

I also had this problem (rails + puma + nginx). Each redirect_to was sent to https , even if it came from http .

In vhost.conf was a line:

 proxy_set_header X-Forwarded-Proto https; 

redirect_to worked correctly after changing this value to

 proxy_set_header X-Forwarded-Proto http; 

Answer 5

I had the same problem. The solution for me was:

• Remove config.force_ssl = true from aplication.rb
• For ubuntu Ctrl + Shift + Del => Clear view data