Rails SSL Plugin Requirement - Should you check if you are in working mode before redirecting to https?

Question

Take a look at the ssl_requirement plugin.

Should you check if you are in production mode? We see a redirect to https in development mode, which seems strange. Or is this normal behavior for the plugin? I thought in the past he behaved differently.

Answer 1

I think they believe that you should probably use HTTPS (possibly with a self-signed certificate) in development mode. If this is not the desired behavior, you will not be bothered by the special SSL behavior in the shell in the development environment:

class YourController < ApplicationController ssl_required :update unless Rails.env.development? end 

Answer 2

  def ssl_required? return false if local_request? || RAILS_ENV == 'test' || RAILS_ENV == 'development' super end 

Answer 3

Ideally, you should verify that your application redirects to https in sensitive stages.

Answer 4

In the development environment, no special SSL requirement is required.

Can you drown ssl_required plugins ? using Rails built into mocking tools.

In your application root directory create test / mocks / development / application.rb

 require 'controllers/application_controller' class ApplicationController < ActionController::Base def ssl_required? false end end 

Therefore, SSL is never required in a development environment.

Answer 5

In fact, https redirection is the responsibility of the web server. Adding additional hash request verification for each request in Rails is a utility IMHO. I wrote nginx config which include the following rewrite:

rewrite ^ (. *) https: // $ host $ 1 persistent;