Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

enforce SSL rails3 plugin

tree: 0a99e4522b

Fetching latest commit…

Octocat-spinner-32-eaf2f5

Cannot retrieve the latest commit at this time

Octocat-spinner-32 demo
Octocat-spinner-32 enforce-ssl-gem
Octocat-spinner-32 .gitignore
Octocat-spinner-32 README.textile
Octocat-spinner-32 pom.xml first import October 29, 2010
README.textile

Enforce SSL for you controllers

with the advent of hijacking tools for dummies like firesheep the need for securing your sessions with ssl is there and it is important that every and any request goes over ssl. this plugin does make the server side secure by redirecting the browser to the ssl port if not used. the client side there is HTTP_Strict_Transport_Security which is implemented by all modern browsers but it relies on a valid (not self-signed) certificate. with that HSTS header in place the browser uses only https requests to communicate with the server.

this gem is derived from the rails/ssl_requirement and adopted a more strict approach: secure everything and open it where needed. also it adds HSTS support per default on production – you can turn it off per config.

info about the actual gem please look into the directory enforce-ssl-gem

demo rails application

the demo is a sample rails3 application with integration tests. see readme how to start the application and what limitations apply.

run all the tests + integrations-tests in one go

first you need jruby for this ! then you need to install ruby-maven

        jruby -S gem install ruby-maven

which allows to run the integration-tests from the demo with jetty.

now you can execute

        rmvn install

ruby-maven

this gem comes with command jetty-run which runs a jetty server with a http port and https port so with this you “test” this rails plugin. in case you start the regular webrick on port 3000 (or any other then 8080) will not apply the ssl redirect, so you can develop your application as usual with those server.

Something went wrong with that request. Please try again.