SSL Requirement plugin
Clone or download
#15 Compare This branch is 51 commits ahead, 4 commits behind yardstick:master.
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.


This version of SSL Requirement is only compatible with Rails 3.x. To install add the following line to your project's Gemfile:

gem 'bartt-ssl_requirement', '~>1.4.0', :require => 'ssl_requirement'

bartt-ssl_requirement is compatible with ruby 1.8.7 and 1.9.x.

SSL Requirement

SSL requirement adds a declarative way of specifying that certain actions should only be allowed to run under SSL, and if they're accessed without it, they should be redirected.


class ApplicationController < ActionController::Base
  include ::SslRequirement

class AccountController < ApplicationController
  ssl_required :signup, :payment
  ssl_allowed :index

  def signup
    # Non-SSL access will be redirected to SSL

  def payment
    # Non-SSL access will be redirected to SSL

  def index
    # This action will work either with or without SSL

  def other
    # SSL access will be redirected to non-SSL

If a majority (or all) of your actions require SSL, then use ssl_exceptions instead of ssl_required. You can list out the actions that you do NOT want to be SSL protected. Calling ssl_exceptions without any actions listed will make ALL actions SSL protected.

To allow SSL for any action use ssl_allowed and pass in :all


This will enable SSL for any action in your application.

class ApplicationController < ActionController::Base include ::SslRequirement

  ssl_allowed :all

You can overwrite the protected method ssl_required? to rely on other things than just the declarative specification. Say, only premium accounts get SSL.

For SSL domains that differ from the domain of the redirecting site, add the following code to development.rb / test.rb / production.rb:

# Redirects to instead of the default
config.after_initialize do
  SslRequirement.ssl_host = ''

For non-SSL domains that differ from domain of redirecting site, add the following code to development.rb / test.rb / production.rb:

Redirects to instead of the default

config.after_initialize do SslRequirement.non_ssl_host = '' end

You can also use a Proc to determine the ssl_host or non_ssl_host on the fly:

config.after_initialize do SslRequirement.ssl_host = do '' end end

You are able to turn off ssl redirects by adding the following environment configuration file:

SslRequirement.disable_ssl_check = true

You are able to the change the status code (defaults to 302) of the redirect by addng the following to the environment configuration file:

SslRequirement.redirect_status = :moved_permanently

P.S.: Beware when you include the SslRequirement module. At the time of inclusion, it'll add the before_filter that validates the declarations. Some times you'll want to run other before_filters before that. They should then be declared ahead of including this module.

SSL URL Helper

This plugin also adds a helper a :secure option to url_for and named_routes. This property allows you to set a url as secure or not secure. It uses the disable_ssl_check to determine if the option should be ignored or not so you can develop as normal. It also will obey if you override SslRequirement.ssl_host or SslRequirement.non_ssl_host (see above)

Here is an example of creating a secure url:

<%= url_for(:controller => "c", :action => "a", :secure => true) %>

If disable_ssl_check returns false url_for will return the following:

Furthermore, you can use the secure option in a named route to create a secure form as follows:

<% form_tag session_path(:secure => true), :class => 'home_login' do -%>
    <label for="name">Email</label>
    <%= text_field_tag 'email', '', :class => 'text', :tabindex => 1 %>
    <label for="password">Password</label>
    <%= password_field_tag 'password', '', :class => 'text', :tabindex => 2 %>
    <%= submit_tag "Login", :id => 'login_submit', :value => "", :alt => "Login" %>
<% end -%>


Copyright (c) 2005 David Heinemeier Hansson, released under the MIT license