SSL Requirement plugin
Pull request Compare This branch is 2 commits ahead of tyler:master.
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.


SSL Requirement

SSL requirement adds a declarative way of specifying that certain actions
should only be allowed to run under SSL, and if they're accessed without it,
they should be redirected.


  class ApplicationController < ActionController::Base
    include SslRequirement

  class AccountController < ApplicationController
    ssl_required :signup, :payment 
    ssl_allowed :index
    def signup
      # Non-SSL access will be redirected to SSL
    def payment
      # Non-SSL access will be redirected to SSL

    def index
      # This action will work either with or without SSL

    def other
      # SSL access will be redirected to non-SSL
If a majority (or all) of your actions require SSL, then use ssl_exceptions instead of ssl_required.
You can list out the actions that you do NOT want to be SSL protected. Calling ssl_exceptions without 
any actions listed will make ALL actions SSL protected. 
You can overwrite the protected method ssl_required? to rely on other things
than just the declarative specification. Say, only premium accounts get SSL.

For SSL domains that differ from the domain of the redirecting site, add the 
following code to development.rb / test.rb / production.rb:

# Redirects to instead of the default 
config.after_initialize do
  SslRequirement.ssl_host = ''

You are able to turn disable ssl redirects by adding the following environment configuration file:
  SslRequirement.disable_ssl_check = true
P.S.: Beware when you include the SslRequirement module. At the time of
inclusion, it'll add the before_filter that validates the declarations. Some
times you'll want to run other before_filters before that. They should then be
declared ahead of including this module.
SSL URL Helper
This plugin also adds a helper a :secure option to url_for and named_routes. This property
allows you to set a url as secure or not secure. It uses the disable_ssl_check to determine
if the option should be ignored or not so you can develop as normal.

Here is an example of creating a secure url:

<%= url_for(:controller => "c", :action => "a", :secure => true) %>

If disable_ssl_check returns false url_for will return the following:

Furthermore, you can use the secure option in a named route to create a secure form as follows:

<% form_tag session_path(:secure => true), :class => 'home_login' do -%>
    <label for="name">Email</label>
    <%= text_field_tag 'email', '', :class => 'text', :tabindex => 1 %>
    <label for="password">Password</label>
    <%= password_field_tag 'password', '', :class => 'text', :tabindex => 2 %>
    <%= submit_tag "Login", :id => 'login_submit', :value => "", :alt => "Login" %>
<% end -%>

Copyright (c) 2005 David Heinemeier Hansson, released under the MIT license