# Ssl\_requirement ajax call from non https to https **URL:** \ **Category:** Rails\ **Created:** [July 31, 2008, 2:46am UTC](https://www.ruby-forum.com/t/ssl-requirement-ajax-call-from-non-https-to-https/144571 "2008-07-31T02:46:42Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [July 31, 2008, 2:46am UTC](https://www.ruby-forum.com/t/ssl-requirement-ajax-call-from-non-https-to-https/144571/1 "2008-07-31T02:46:42Z")
I have a page that has nothing on it that needs to be secured by SSL, except when someone wants to hit an ajax request to login. I don’t want to secure every page, just so that when I render a partial that needs to be https, it’ll be protected. I’m using the ssl\_requirement plugin. Any ideas on what to do? Is this even possible? Or will I have to encrypt every single page? I’d rather not do popup windows, everything’s nice and slickly inserted with cool DOM manipulation. Thanks! ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [July 31, 2008, 12:49pm UTC](https://www.ruby-forum.com/t/ssl-requirement-ajax-call-from-non-https-to-https/144571/2 "2008-07-31T12:49:57Z")
On 31 Jul 2008, at 01:46, -kinetic wrote: > I have a page that has nothing on it that needs to be secured by SSL, > except when someone wants to hit an ajax request to login. > > I don’t want to secure every page, just so that when I render a > partial that needs to be https, it’ll be protected. I think that single origin policy says you can’t do that. If your login form is a regular form then you’ll be ok. Fred ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [July 31, 2008, 9:08pm UTC](https://www.ruby-forum.com/t/ssl-requirement-ajax-call-from-non-https-to-https/144571/3 "2008-07-31T21:08:03Z")
Yes, but a regular form will submit non ssl encrypted information, so that would defeat the purpose. So I need to render the partial as https… but only when I need. Currently there’s a link\_to\_remote that hits an action that’s ssl\_required, but that doesn’t work unless the page that’s going to render that partial through ajax is also ssl\_required. Since this link\_to\_remote lives everywhere, that’d mean my entire site needs to be secured by ssl. That’s ridiculous. I’m sure this is a common problem, what are people doing to solve this issue? On Jul 31, 3:49 am, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [August 1, 2008, 12:57am UTC](https://www.ruby-forum.com/t/ssl-requirement-ajax-call-from-non-https-to-https/144571/4 "2008-08-01T00:57:01Z")
So if I modified my form to use a https protocol, I could load up the form without it being https, and the submission would still be SSL secured? On Jul 31, 12:46 pm, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [August 1, 2008, 9:32am UTC](https://www.ruby-forum.com/t/ssl-requirement-ajax-call-from-non-https-to-https/144571/5 "2008-08-01T09:32:10Z")
On Jul 31, 11:56 pm, -kinetic [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > So if I modified my form to use a https protocol, I could load up the > form without it being https, and the submission would still be SSL > secured? Yup, that should work (with a non ajax form) Fred ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [August 1, 2008, 10:19pm UTC](https://www.ruby-forum.com/t/ssl-requirement-ajax-call-from-non-https-to-https/144571/6 "2008-08-01T22:19:16Z")
In theory it should work, but with this ssl\_requirement plugin, it’s still not happy. When I try to give my form a protocol, it does a few different things: :protocol =\> ‘https’ yields this on my localhost (for testing): httpslocalhost/controller/ action Which is really weird. And nothing happens if I give it the https:// protocol. It might be a problem with my lighty setup proxying the ssl over to the mongrel. I know lighty sits on port 80, so it might not be hit correctly, while ssl\_requirement will forward you correctly. Any other ideas? Thanks again for your help so far. On Aug 1, 12:31 am, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [July 31, 2008, 9:47pm UTC](https://www.ruby-forum.com/t/ssl-requirement-ajax-call-from-non-https-to-https/144571/7 "2008-07-31T21:47:53Z")
On 31 Jul 2008, at 20:07, -kinetic wrote: > Yes, but a regular form will submit non ssl encrypted information, so > that would defeat the purpose. Not if you set the url for that normal form to be an https one. Still doesn’t help you as far as the ajaxyness goes. Is it not acceptable for the link\_to\_remote to insert into the page a form (and for that form submit to be a regular non ajax form) ? Fred ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [August 2, 2008, 1:26am UTC](https://www.ruby-forum.com/t/ssl-requirement-ajax-call-from-non-https-to-https/144571/8 "2008-08-02T01:26:36Z")
On 1 Aug 2008, at 21:18, -kinetic wrote: > In theory it should work, but with this ssl\_requirement plugin, it’s > still not happy. When I try to give my form a protocol, it does a few > different things: > > :protocol =\> ‘https’ > > yields this on my localhost (for testing): httpslocalhost/controller/ > action hmm, protocol =\> ‘https://’ should work if i recall correctly. As a test, does it work if you specify the url in full (ie just hardcode [https://localhost/foo/bar](https://localhost/foo/bar)) ? Fred ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [August 4, 2008, 9:35pm UTC](https://www.ruby-forum.com/t/ssl-requirement-ajax-call-from-non-https-to-https/144571/9 "2008-08-04T21:35:30Z")
protocol =\> ‘https://’ does work, but it’s weird that we have to include the ://. Anyway, I ended up using the iframe trick of doing a target in the form tag. I still can’t believe more people don’t have this issue? I’m getting a problem now that it’s no longer AJAX’y. I’m using a responds\_to\_parent plugin which doesn’t seem to be working either. Nobody else has ever come across this issue? On Aug 1, 4:26 pm, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)