# Https going back to http after forms -- why?

**URL:** <https://www.ruby-forum.com/t/https-going-back-to-http-after-forms-why/120819>\
**Category:** Rails\
**Created:** [November 20, 2007, 8:54pm UTC](https://www.ruby-forum.com/t/https-going-back-to-http-after-forms-why/120819 "2007-11-20T20:54:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [November 20, 2007, 8:54pm UTC](https://www.ruby-forum.com/t/https-going-back-to-http-after-forms-why/120819/1 "2007-11-20T20:54:58Z")

</div>

Yello,  
When people login to my site, they are redirected to  
[https://mysite.org/their\_account](https://mysite.org/their_account) That part is working fine for me.

The problem comes when I use form\_tags. After they click the submit  
button, the next page they land on is http

My question is, how can I keep them on https, even after they fill out a  
form and hit submit?

My form tag seems to be producing the right HTML, but it still doesn’t  
keep them in https  
\<%= form\_tag( {:protocol =\> ‘https://’, :only\_path =\> false, :action =\>  
:pre\_checkout }, {:class =\> ‘form-large’}) %\>

Any ideas on this?

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [November 21, 2007, 10:49pm UTC](https://www.ruby-forum.com/t/https-going-back-to-http-after-forms-why/120819/2 "2007-11-21T22:49:09Z")

</div>

I had roughly the same problem and in my case it was because the  
proper headers weren’t being set. Rails uses certain headers to  
determine if the current request is using SSL and thus if it should  
use https:// when generating URLs with url\_for(). I had to add the  
following line to my Apache configuration for the secure virtualhost  
to get it to work:

```
RequestHeader set X_FORWARDED_PROTO 'https'

```

A quick glance at the ActionController source reveals this method:

```
# Is this an SSL request?
def ssl?
  @env['HTTPS'] == 'on' || @env['HTTP_X_FORWARDED_PROTO'] ==

```

‘https’  
end

I’m not sure why I didn’t need to append “HTTP\_” to the request header  
name, but it works (probably because somewhere along the line it gets  
appended automatically.)

Try setting any of these headers in your web server’s configuration.

Best of luck.

Ian

On Nov 20, 11:54 am, Joe P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [November 27, 2007, 9:42pm UTC](https://www.ruby-forum.com/t/https-going-back-to-http-after-forms-why/120819/3 "2007-11-27T21:42:06Z")

</div>

If you use the ssl\_requirement plugin, then you can just declare the  
action to which your form is submitting as requiring ssl in the  
controller, and you don’t need the protocol specification in the  
form\_tag.

Michael S.  
[www.BuildingWebApps.com](http://www.BuildingWebApps.com)

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [December 6, 2007, 8:28pm UTC](https://www.ruby-forum.com/t/https-going-back-to-http-after-forms-why/120819/4 "2007-12-06T20:28:22Z")

</div>

The real problem is that his application isn’t recognizing that it’s  
currently being accessed via SSL, so all the URLs are being generated  
with http:// instead of https://. If he used the ssl\_requirement plug-  
in without addressing the matter of the environment variable, that  
plug-in would cause an infinite loop of redirects, as it would  
continuously think it wasn’t being access via SSL even though it was.