# Actual flow of a redirect\_to

**URL:** <https://www.ruby-forum.com/t/actual-flow-of-a-redirect-to/121760>\
**Category:** Rails\
**Created:** [November 30, 2007, 5:55pm UTC](https://www.ruby-forum.com/t/actual-flow-of-a-redirect-to/121760 "2007-11-30T17:55:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pkoebbe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ec9cab/32.png) [@pkoebbe](https://www.ruby-forum.com/u/pkoebbe)\
**Post date:** [November 30, 2007, 5:55pm UTC](https://www.ruby-forum.com/t/actual-flow-of-a-redirect-to/121760/1 "2007-11-30T17:55:53Z")

</div>

I’m working on implementing SSL in my application and I have a  
question about how redirect\_to actually works. Here’s a scenario:

Suppose I want my login action to be available only over SSL so the  
username and password will be transmitted encrypted. In my  
controller, I would have something like

before\_filter :require\_ssl, :only =\> {:login}

and

def require\_ssl  
redirect\_to :protocol =\> ‘https://’ unless (request.ssl? or  
request.local?)  
end

[ by the way, this is not necessarily how I’m doing it in my app, but  
this works very well for this question]

When the browser makes the initial request to the server, is the form  
data passed along at that time or is the redirect handled in some  
sort of handshaking process before the form data is passed? If the  
data is passed to the server in the initial request, then it will be  
unencrypted if it comes in on http, which really does no good because  
it is exposed between the client and server.

The question I’m trying to answer for myself is do I want my entire  
application behind ssl, just to be safe, or do I want to leave open  
those actions that don’t really need it (very few in this case). I  
noticed that when you go to [http://www.paypal.com](http://www.paypal.com), you are  
automatically redirected to https, so even the login form is already  
behind ssl.

Thanks for any insight and help in understanding this process.

Peace,  
Phillip

---

<div class="post-metadata">

**Author:** ![pkoebbe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ec9cab/32.png) [@pkoebbe](https://www.ruby-forum.com/u/pkoebbe)\
**Post date:** [November 30, 2007, 5:58pm UTC](https://www.ruby-forum.com/t/actual-flow-of-a-redirect-to/121760/2 "2007-11-30T17:58:14Z")

</div>

There is no handshake magic. Rails simply sends a response to the  
browser with a 302 header in it.

-Bill

Phillip K. wrote:

> sort of handshaking process before the form data is passed? If the
> 
> Thanks for any insight and help in understanding this process.
> 
> Peace,  
> Phillip
> 
> >

–  
Sincerely,

William P.

---

<div class="post-metadata">

**Author:** ![pkoebbe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ec9cab/32.png) [@pkoebbe](https://www.ruby-forum.com/u/pkoebbe)\
**Post date:** [November 30, 2007, 6:16pm UTC](https://www.ruby-forum.com/t/actual-flow-of-a-redirect-to/121760/3 "2007-11-30T18:16:59Z")

</div>

Hi Bill,

So the form data gets passed to the server, the server responds with  
the 302 and the client resubmits the form data to the “new” url? In  
this case, the unencrypted data will be sent to the server first,  
then the encrypted data will be sent, correct?

Thanks,  
Phillip

---

<div class="post-metadata">

**Author:** ![pkoebbe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ec9cab/32.png) [@pkoebbe](https://www.ruby-forum.com/u/pkoebbe)\
**Post date:** [November 30, 2007, 6:32pm UTC](https://www.ruby-forum.com/t/actual-flow-of-a-redirect-to/121760/4 "2007-11-30T18:32:16Z")

</div>

You got it.

Phillip K. wrote:

> On Nov 30, 2007, at 10:57 AM, William P. wrote:

–  
Sincerely,

William P.