# Problem: open-uri blocking redirection from http to https

**URL:** <https://www.ruby-forum.com/t/problem-open-uri-blocking-redirection-from-http-to-https/203348>\
**Category:** Ruby\
**Created:** [February 18, 2011, 5:57am UTC](https://www.ruby-forum.com/t/problem-open-uri-blocking-redirection-from-http-to-https/203348 "2011-02-18T05:57:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [February 18, 2011, 5:57am UTC](https://www.ruby-forum.com/t/problem-open-uri-blocking-redirection-from-http-to-https/203348/1 "2011-02-18T05:57:00Z")

</div>

Hello,

I was working on a small script to verify the presence of an element  
through a list of URL, some of these URLs have a redirections from http  
to  
https, when the script crawled into them I got the following error:

/usr/lib/ruby/1.9.1/open-uri.rb:216:in `open\_loop’: redirection  
forbidden:  
[http://beta.carsdirect.com/auto-loans/finance-app](http://beta.carsdirect.com/auto-loans/finance-app) →   
[https://beta.carsdirect.com/auto-loans/finance-app](https://beta.carsdirect.com/auto-loans/finance-app) (RuntimeError)

I understand that this is intentional, as per the comments on  
open-uri.rb

```
 # This test is intended to forbid a redirection from http://... to
 # file:///etc/passwd.
 # https to http redirect is also forbidden intentionally.
 # It avoids sending secure cookie or referer by non-secure HTTP

```

protocol.  
# (RFC 2109 4.3.1, RFC 2965 3.3, RFC 2616 15.1.3)  
# However this is ad hoc. It should be extensible/configurable.

This mentions that “https to http” redirects are forbidden  
intentionally,  
but redirections from “http to https” are also blocked.

Is there a way to override this security check? currently I had to  
change the  
following line in the library to allow “http to https” re-directions:

(/\A(?:http|ftp)\z/i =~ uri1.scheme && /\A(?:http|ftp)\z/i =~  
uri2.scheme)

to

(/\A(?:http|ftp|https)\z/i =~ uri1.scheme && /\A(?:http|ftp|https)\z/i  
=~  
uri2.scheme)

Thanks,  
Xavi

---

<div class="post-metadata">

**Author:** ![Xavier\_Del\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/x/ecd19e/32.png) [@Xavier\_Del\_C](https://www.ruby-forum.com/u/Xavier_Del_C)\
**Post date:** [February 28, 2011, 2:33pm UTC](https://www.ruby-forum.com/t/problem-open-uri-blocking-redirection-from-http-to-https/203348/2 "2011-02-28T14:33:45Z")

</div>

2011/2/18 Xavier Del C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> # However this is ad hoc. It should be extensible/configurable.
> 
> This mentions that “https to http” redirects are forbidden intentionally,  
> but redirections from “http to https” are also blocked.
> 
> Is there a way to override this security check? currently I had to change  
> the  
> following line in the library to allow “http to https” re-directions:
> 
> (/\A(?:http|ftp)\z/i =~ uri1.scheme && /\A(?:http|ftp)\z/i =~ uri2.scheme)

Currently it is not configurable (as the comment says) except monkey  
patching.

Maybe open-uri should have some hooks.