# Rails/Apache/Mongrel/SSL **URL:** \ **Category:** Rails\ **Created:** [September 4, 2008, 9:14pm UTC](https://www.ruby-forum.com/t/rails-apache-mongrel-ssl/147739 "2008-09-04T21:14:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![bmcelhany](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/a88e57/32.png) [@bmcelhany](https://www.ruby-forum.com/u/bmcelhany)\ **Post date:** [September 4, 2008, 9:14pm UTC](https://www.ruby-forum.com/t/rails-apache-mongrel-ssl/147739/1 "2008-09-04T21:14:46Z")
Hi all, I’m looking for a little guidance here in setting up my .htacces and/ or httpd.conf files. I’ve got a single Rails app that happens to have two domains pointing to it…let’s say [www.domain1.com](http://www.domain1.com) and [www.domain2.com](http://www.domain2.com). [www.domain2.com](http://www.domain2.com) has an SSL certificate associated with it, so any request can be made via http or https and this seems to be working fine ([domain1.com](http://domain1.com) can only be accessed via http). My problem is that I need all actions for a particular controller (registration) to be encrypted. The possible actions are: /registration /registration/showClasses /registration/showForm /registration/sendRegistration /registration/sendQuestionnaire If any requests are made to [http://www.domain1.com/registration/](http://www.domain1.com/registration/) (1st domain, un-encrypted) or [http://www.domain2.com/registration/](http://www.domain2.com/registration/) (2nd domain, un-encrypted) then they should be forwarded to [https://www.domain2.com/registration/](https://www.domain2.com/registration/) (2nd domain, encrypted). Any other request (to any controller OTHER THAN the registration controller) should be forwarded to [http://www.domain1.com/controller/](http://www.domain1.com/controller/). At this point, the SSL seems to be set up just fine…I can go to [https://www.domain2.com](https://www.domain2.com) and get a secure page. However there’s nothing keeping me from just changing the protocol to http in the address bar or changing the whole address to [http://www.domain1.com](http://www.domain1.com) and just bypassing the SSL encryption entirely. Any thoughts? Thanks! -Brian ---
**Author:** ![bmcelhany](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/a88e57/32.png) [@bmcelhany](https://www.ruby-forum.com/u/bmcelhany)\ **Post date:** [September 4, 2008, 9:18pm UTC](https://www.ruby-forum.com/t/rails-apache-mongrel-ssl/147739/2 "2008-09-04T21:18:53Z")
Here you go =\> [GitHub - rails/ssl\_requirement: NOTICE: official repository moved to https://github.com/retr0h/ssl\_requirement](http://github.com/rails/ssl_requirement/tree/master) On Thu, Sep 4, 2008 at 4:14 PM, bmcelhany [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > My problem is that I need all actions for a particular controller > (2nd domain, un-encrypted) then they should be forwarded to > > Any thoughts? Thanks! > > -Brian > > > – Maurício Linhares [http://alinhavado.wordpress.com/](http://alinhavado.wordpress.com/) (pt-br) | [http://blog.codevader.com/](http://blog.codevader.com/) (en) João Pessoa, PB, +55 83 8867-7208 ---
**Author:** ![bmcelhany](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/a88e57/32.png) [@bmcelhany](https://www.ruby-forum.com/u/bmcelhany)\ **Post date:** [September 4, 2008, 9:40pm UTC](https://www.ruby-forum.com/t/rails-apache-mongrel-ssl/147739/3 "2008-09-04T21:40:35Z")
Hi Mauricio, Thanks for the link…this definitely looks like it will get me going in the right direction. Is there a way, using this plug-in, to specify that when an “ssl\_required” action is called that it needs to be directed to the [https://www.domain2.com](https://www.domain2.com) domain? In other words, if a user requests a secure action from the 1st domain, it’s not enough to simply change the protocol from http to https…it needs to be redirected to the 2nd domain (it’s the only one with an SSL certificate). Does that make sense at all? -Brian On Sep 4, 12:18 pm, “Maurício Linhares” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![bmcelhany](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/a88e57/32.png) [@bmcelhany](https://www.ruby-forum.com/u/bmcelhany)\ **Post date:** [September 4, 2008, 10:01pm UTC](https://www.ruby-forum.com/t/rails-apache-mongrel-ssl/147739/4 "2008-09-04T22:01:43Z")
That seems to do the trick. Thanks! On Sep 4, 12:46 pm, “Maurício Linhares” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![bmcelhany](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/a88e57/32.png) [@bmcelhany](https://www.ruby-forum.com/u/bmcelhany)\ **Post date:** [September 4, 2008, 9:47pm UTC](https://www.ruby-forum.com/t/rails-apache-mongrel-ssl/147739/5 "2008-09-04T21:47:38Z")
Hi Brian, I think it’s completely possible, looking at the source code, the method that sends the client to the SSL enabled page is this one: ``` def ensure_proper_protocol return true if ssl_allowed? if ssl_required? && !request.ssl? redirect_to "https://" + request.host + request.request_uri flash.keep return false elsif request.ssl? && !ssl_required? redirect_to "http://" + request.host + request.request_uri flash.keep return false end end ``` You would just have to tweak it to your own needs. On Thu, Sep 4, 2008 at 4:40 PM, bmcelhany [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > the protocol from http to https…it needs to be redirected to the 2nd > domain (it’s the only one with an SSL certificate). Does that make > sense at all? > > -Brian – Maurício Linhares [http://alinhavado.wordpress.com/](http://alinhavado.wordpress.com/) (pt-br) | [http://blog.codevader.com/](http://blog.codevader.com/) (en) João Pessoa, PB, +55 83 8867-7208 ---
**Author:** ![bmcelhany](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/a88e57/32.png) [@bmcelhany](https://www.ruby-forum.com/u/bmcelhany)\ **Post date:** [September 4, 2008, 10:58pm UTC](https://www.ruby-forum.com/t/rails-apache-mongrel-ssl/147739/6 "2008-09-04T22:58:40Z")
On 4 Sep 2008, at 21:14, bmcelhany [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > https://www.domain2.com and get a secure page. However there's nothing keeping me from just changing the protocol to http in the address bar or changing the whole address to http://www.domain1.com and just bypassing the SSL encryption entirely. > > Any thoughts? Thanks! Stick a before\_filter that checks whether it’s an ssl request?