# Ssl\_requirement does not redirect to https

**URL:** <https://www.ruby-forum.com/t/ssl-requirement-does-not-redirect-to-https/129619>\
**Category:** Rails\
**Created:** [February 20, 2008, 3:31am UTC](https://www.ruby-forum.com/t/ssl-requirement-does-not-redirect-to-https/129619 "2008-02-20T03:31:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bobbysantiago](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/c89c15/32.png) [@bobbysantiago](https://www.ruby-forum.com/u/bobbysantiago)\
**Post date:** [February 20, 2008, 3:31am UTC](https://www.ruby-forum.com/t/ssl-requirement-does-not-redirect-to-https/129619/1 "2008-02-20T03:31:20Z")

</div>

I’m trying to get SSL working on my app, using ssl\_requirement. SSL is  
working, but ssl\_requirement doesn’t seem to be handling the request  
properly- it doesn’t redirect to https.

Relevant files:

application.rb:  
class ApplicationController \< ActionController::Base  
include SslRequirement  
include AuthenticatedSystem

def ssl\_required?  
return false if local\_request? || RAILS\_ENV == ‘test’  
super  
end  
…  
end

users\_controller.rb:  
class UsersController \< ApplicationController  
ssl\_required :new, :create, :reset\_password

…  
end

vhost.conf:  
( VirtualHost \*:80 is a duplicate of the code below, except for the  
first 2 lines)  
\<VirtualHost 123.123.123.123:443\>  
SSLEngine on  
RequestHeader set X\_FORWARDED\_PROTO “https”

DocumentRoot /var/www/apps/my\_app/current/public

\<Directory /var/www/apps/my\_app/current/public\>  
Options FollowSymLinks  
AllowOverride None  
Order allow,deny  
Allow from all

# Configure mongrel\_cluster

\<Proxy balancer://my\_app\_cluster\>  
BalancerMember [http://127.0.0.1:8000](http://127.0.0.1:8000)  
BalancerMember [http://127.0.0.1:8001](http://127.0.0.1:8001)

RewriteEngine On

# Prevent access to .svn directories

RewriteRule ^(.\*/)?.svn/ - [F,L]  
ErrorDocument 403 “Access Forbidden”

# Check for maintenance file and redirect all requests

RewriteCond %{DOCUMENT\_ROOT}/system/maintenance.html -f  
RewriteCond %{SCRIPT\_FILENAME} !maintenance.html  
RewriteRule ^.\*$ /system/maintenance.html [L]

# Rewrite index to check for static

RewriteRule ^/$ /index.html [QSA]

# Rewrite to check for Rails cached page

RewriteRule ^([^.]+)$ $1.html [QSA]

# Redirect all non-static requests to cluster

RewriteCond %{DOCUMENT\_ROOT}/%{REQUEST\_FILENAME} !-f  
RewriteRule ^/(.\*)$ balancer://my\_app\_cluster%{REQUEST\_URI}  
[P,QSA,L]

# Deflate

AddOutputFilterByType DEFLATE text/html text/plain text/xml  
BrowserMatch ^Mozilla/4 gzip-only-text/html  
BrowserMatch ^Mozilla/4.0[678] no-gzip  
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

ErrorLog logs/my\_app.com-error\_log  
CustomLog logs/my\_app.com-access\_log combined

# This just specifies locations of key and crt files

Include /etc/httpd/conf/apps/ssl.conf

In production, the app just throws a 404 when I try to access  
https://my\_app.com/signup.

My specs:

describe “Requesting /signup” do  
controller\_name :users

before(:each) do  
@user = mock\_model(User, :to\_param =\> “1”, :save =\> true)  
User.stub!(:new).and\_return(@user)  
end

def do\_get  
get :new  
end

it “should redirect to HTTPS version if request.ssl? is false” do  
request.stub!(:ssl?).and\_return false  
do\_get  
response.should redirect\_to(“[https://test.host/signup](https://test.host/signup)”)  
end

it “should redirect to the HTTPS version” do  
request.stub!(:ssl?).and\_return true  
do\_get  
response.should redirect\_to(“[https://test.host/signup](https://test.host/signup)”)  
end  
end

autotest spits out:  
‘Requesting /signup should redirect to the HTTPS version’ FAILED  
expected redirect to “[https://test.host/signup](https://test.host/signup)”, got redirect to  
“[http://test.host/signup](http://test.host/signup)”

‘Requesting /signup (/users/new) should redirect to HTTPS version if  
request.ssl? is false’ FAILED  
expected redirect to “[https://test.host/signup](https://test.host/signup)”, got no redirect

When I try to access the production site via the command line, I get  
this:  
$ curl -I https://my\_app.com/signup  
HTTP/1.1 302 Moved Temporarily  
Date: Tue, 19 Feb 2008 07:52:24 GMT  
Server: Mongrel 1.0.1  
Status: 302 Found  
Location: http://my\_app.com/signup  
Cache-Control: no-cache  
Content-Type: text/html; charset=utf-8  
Content-Length: 107  
Set-Cookie: \_my\_app\_session\_id=7eeea00b749ef2ed8b06730b18c62646;  
path=/  
Vary: Accept-Encoding  
Connection: close

$ curl -I http://my\_app.com/signup  
HTTP/1.1 200 OK  
Date: Tue, 19 Feb 2008 07:52:40 GMT  
Server: Mongrel 1.0.1  
Status: 200 OK  
Cache-Control: no-cache  
Content-Type: text/html; charset=utf-8  
Vary: Accept-Encoding  
Content-length: 12031  
Connection: Keep-Alive  
Set-Cookie: \_my\_app\_session\_id=5c8fd1c3f962b65aeeb6a4b6299c3e46;  
path=/

The request is getting past Apache, it looks like the app itself is  
not handling the request correctly.

Has anyone encountered this problem before? Any help would be much  
appreciated.

Bobby

---

<div class="post-metadata">

**Author:** ![bobbysantiago](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/c89c15/32.png) [@bobbysantiago](https://www.ruby-forum.com/u/bobbysantiago)\
**Post date:** [February 20, 2008, 9:48am UTC](https://www.ruby-forum.com/t/ssl-requirement-does-not-redirect-to-https/129619/2 "2008-02-20T09:48:27Z")

</div>

try to comment out  
def ssl\_required?  
return false if local\_request? || RAILS\_ENV == ‘test’  
super  
end

In your test env, you disable ssl with the above code.

I usually set ENV[‘USE\_SSL’] in my env., then application\_controller  
picks it up in ssl\_required?.

---

<div class="post-metadata">

**Author:** ![bobbysantiago](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/c89c15/32.png) [@bobbysantiago](https://www.ruby-forum.com/u/bobbysantiago)\
**Post date:** [February 20, 2008, 11:17pm UTC](https://www.ruby-forum.com/t/ssl-requirement-does-not-redirect-to-https/129619/3 "2008-02-20T23:17:41Z")

</div>

Thanks, I’ll try that. Further debugging also indicates a conflict  
with a plugin, will just have to find out which.

On Feb 20, 4:48 pm, Yaxm Y. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)