# Http to https redirect

**URL:** <https://www.ruby-forum.com/t/http-to-https-redirect/159957>\
**Category:** Ruby\
**Created:** [February 10, 2009, 12:34pm UTC](https://www.ruby-forum.com/t/http-to-https-redirect/159957 "2009-02-10T12:34:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rejikumarrv](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/77aa72/32.png) [@rejikumarrv](https://www.ruby-forum.com/u/rejikumarrv)\
**Post date:** [February 10, 2009, 12:34pm UTC](https://www.ruby-forum.com/t/http-to-https-redirect/159957/1 "2009-02-10T12:34:02Z")

</div>

hi all,  
Needed some help with http to https redirection. I have a  
requirement wherein the login page alone should have https enabled. ie  
the user name & password should be sent to server in encrypted form.  
Once the validation is done, it has to come back to http again. I am  
using apache, compiled with ssl enabled. Initially I tried to have the  
initial request (first url the user types in) itself in https and then  
redirect to http. But I have re-login requests from many places in the  
application (password change, session expiry etc), where I have to do  
the http to https redirection again to display the initial login page.  
This was causing permission issues for some of the java scripts in those  
locations. So to avoid that I put a dummy function (action), as the  
first one. User types in http address only. This dummy action will then  
redirect to https before rendering the login page. Once the validation  
is done it is again changed back to http. The re-login actions also work  
as they go back to this dummy action which is in http only. The sequence  
is as follows

[http://localhost:4000/login/prompt](http://localhost:4000/login/prompt) (as entered by user. prompt is  
dummy)  
[https://localhost:4001/login/secureprompt](https://localhost:4001/login/secureprompt) (to https. renders login page)  
[http://localhost:4000/login/show\_frame](http://localhost:4000/login/show_frame) (inside the application)

The prompt action is as follows  
def prompt  
full\_url = “[https://localhost:4001/login/secureprompt](https://localhost:4001/login/secureprompt)”  
redirect\_to full\_url  
end

Eventhough the login page is in https, it is found that the user name &  
password can be seen by capturing the packets using the tool “HTTP  
Analyzer”. Could somebody please explain why this is happening? Any help  
is appreciated.

---

<div class="post-metadata">

**Author:** ![rejikumarrv](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/77aa72/32.png) [@rejikumarrv](https://www.ruby-forum.com/u/rejikumarrv)\
**Post date:** [February 10, 2009, 12:38pm UTC](https://www.ruby-forum.com/t/http-to-https-redirect/159957/2 "2009-02-10T12:38:54Z")

</div>

I am based out of Bangalore, India. Please excuse if you find any delay  
in my responses, as my day time can be different from yours :).

---

<div class="post-metadata">

**Author:** ![rejikumarrv](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/77aa72/32.png) [@rejikumarrv](https://www.ruby-forum.com/u/rejikumarrv)\
**Post date:** [February 10, 2009, 12:48pm UTC](https://www.ruby-forum.com/t/http-to-https-redirect/159957/3 "2009-02-10T12:48:18Z")

</div>

Or is it that we have to encrypt the user name & password in the  
application itself, before sending to the server. Enabling https alone  
won’t suffice ?

---

<div class="post-metadata">

**Author:** ![rejikumarrv](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/77aa72/32.png) [@rejikumarrv](https://www.ruby-forum.com/u/rejikumarrv)\
**Post date:** [February 10, 2009, 1:53pm UTC](https://www.ruby-forum.com/t/http-to-https-redirect/159957/4 "2009-02-10T13:53:56Z")

</div>

Well, just came to know that http analyzer hooks into windows APIs and  
gives the info. So it is actually showing data before the ssl APIs are  
called, and hence not exactly what is being transferred over network.  
Please comment on the correctness of this info as well.

---

<div class="post-metadata">

**Author:** ![rejikumarrv](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/77aa72/32.png) [@rejikumarrv](https://www.ruby-forum.com/u/rejikumarrv)\
**Post date:** [February 10, 2009, 12:57pm UTC](https://www.ruby-forum.com/t/http-to-https-redirect/159957/5 "2009-02-10T12:57:17Z")

</div>

I removed the back and forth redirection between http and https. Now it  
is completely https. But still I am able to see the user name and  
password as such (without any encryption) in the http analyzer as such.