# Ssl\_required and form\_tag

**URL:** <https://www.ruby-forum.com/t/ssl-required-and-form-tag/155444>\
**Category:** Rails\
**Created:** [December 11, 2008, 8:31pm UTC](https://www.ruby-forum.com/t/ssl-required-and-form-tag/155444 "2008-12-11T20:31:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fritza](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/5f9b8f/32.png) [@fritza](https://www.ruby-forum.com/u/fritza)\
**Post date:** [December 11, 2008, 8:31pm UTC](https://www.ruby-forum.com/t/ssl-required-and-form-tag/155444/1 "2008-12-11T20:31:55Z")

</div>

I don’t quite understand how ssl\_required interacts with forms in Ruby  
on Rails.

I’ve installed the ssl\_requirement plugin, and listed one of my  
form-submission actions (:assign\_building) in an ssl\_required  
declaration. The form is shown at the end of this message.

The form includes a select\_tag to collect a parameter tagged as  
:building\_id.

If :assign\_building is listed in ssl\_required, params does not include  
the :building\_id key. If it’s not in ssl\_required, :building\_id is in  
params.

I should mention that I have defined default\_url\_options to set  
:protocol =\> “https://”.

How do I ensure that my form will be submitted via SSL, and keep all its  
parameters? I’m pretty sure I’m missing a concept here, but of course  
I’m too ignorant to know what that concept might be.

ruby 1.8.6 (2008-03-03 patchlevel 114) [universal-darwin9.0]  
Rails 1.2.6

```
-- F

```

# === \<% form\_tag :controller =\> :people, :action =\> :assign\_building, :id =\> @person do %\> \<% buildings = Building.find(:all, :order =\> ‘facility\_location, building’).collect { |b| [b.building, b.id] } -%\> \<% bldg\_opts = options\_for\_select(buildings, @person.building\_id) -%\> \<%= select\_tag :building\_id, bldg\_opts %\> \<%= submit\_tag “Set” %\> \<% end -%\>

Partial log when ssl\_required is in effect:

Processing PeopleController#assign\_building (for at 2008-12-11  
13:11:50) [GET]  
Session ID: 31c980c882ed498eaed93fcb08916d63  
Parameters: {“action”=\>“assign\_building”, “id”=\>“5”,  
“controller”=\>“people”}

---

<div class="post-metadata">

**Author:** ![fritza](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/5f9b8f/32.png) [@fritza](https://www.ruby-forum.com/u/fritza)\
**Post date:** [December 11, 2008, 9:12pm UTC](https://www.ruby-forum.com/t/ssl-required-and-form-tag/155444/2 "2008-12-11T21:12:42Z")

</div>

Fritz A. wrote:  
…

> The form includes a select\_tag to collect a parameter tagged as  
> :building\_id.
> 
> If :assign\_building is listed in ssl\_required, params does not include  
> the :building\_id key. If it’s not in ssl\_required, :building\_id is in  
> params.
> 
> I should mention that I have defined default\_url\_options to set  
> :protocol =\> “https://”.
> 
> How do I ensure that my form will be submitted via SSL, and keep all its  
> parameters? I’m pretty sure I’m missing a concept here, but of course  
> I’m too ignorant to know what that concept might be.

I added the action that presents the form to ssl\_required. Form inputs  
then once again appeared in the params hash.

My problem is no longer acute, but I don’t quite understand why the  
solution works. Is it that the form isn’t presented as https, so the  
form action isn’t https? And the form data gets lost in the ssl\_required  
redirection?

I’d really appreciate it if someone could relieve my conceptual block  
here.

```
-- F
```

---

<div class="post-metadata">

**Author:** ![fritza](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/5f9b8f/32.png) [@fritza](https://www.ruby-forum.com/u/fritza)\
**Post date:** [December 11, 2008, 9:15pm UTC](https://www.ruby-forum.com/t/ssl-required-and-form-tag/155444/3 "2008-12-11T21:15:36Z")

</div>

On Thu, Dec 11, 2008 at 5:12 PM, Fritz A.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> My problem is no longer acute, but I don’t quite understand why the  
> solution works. Is it that the form isn’t presented as https, so the  
> form action isn’t https? And the form data gets lost in the ssl\_required  
> redirection?

You answered it for youself, if the form isn’t shown in a SSL context,  
it will not post to a SSL page unless you make the form action point  
to a SSL page. And post data is lost when you are redirected.

- 

Maurício Linhares  
[http://alinhavado.wordpress.com/](http://alinhavado.wordpress.com/) (pt-br) | [http://blog.codevader.com/](http://blog.codevader.com/)  
(en)