# SSL Requirement plugin

**URL:** <https://www.ruby-forum.com/t/ssl-requirement-plugin/56371>\
**Category:** Rails\
**Created:** [March 30, 2006, 5:47pm UTC](https://www.ruby-forum.com/t/ssl-requirement-plugin/56371 "2006-03-30T17:47:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![peterk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/7993a0/32.png) [@peterk](https://www.ruby-forum.com/u/peterk)\
**Post date:** [March 30, 2006, 5:47pm UTC](https://www.ruby-forum.com/t/ssl-requirement-plugin/56371/1 "2006-03-30T17:47:38Z")

</div>

Is there any way to have the plugin require SSL to be used for all  
actions in a controller and just specify the ones you dont want to  
require SSL using ssl\_allowed?

class ApplicationController \< ActiveRecord::Base  
include SslRequirement  
ssl\_required _._

Many thanks.

Also I could of course combine this with local.request? so that when  
developing locally http is allowed, but when in production the  
ssl\_required kicks in.

---

<div class="post-metadata">

**Author:** ![peterk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/7993a0/32.png) [@peterk](https://www.ruby-forum.com/u/peterk)\
**Post date:** [March 30, 2006, 5:51pm UTC](https://www.ruby-forum.com/t/ssl-requirement-plugin/56371/2 "2006-03-30T17:51:45Z")

</div>

Here’s how I’m doing it:

before\_filter :require\_ssl, :except =\> [:some\_action, :other\_action]

def require\_ssl  
if !@request.ssl?  
redirect\_to :protocol =\> “https://”  
end  
end

On 3/30/06, Peter P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

–  
[http://www.michaelgorsuch.org](http://www.michaelgorsuch.org)

---

<div class="post-metadata">

**Author:** ![peterk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/7993a0/32.png) [@peterk](https://www.ruby-forum.com/u/peterk)\
**Post date:** [March 30, 2006, 5:54pm UTC](https://www.ruby-forum.com/t/ssl-requirement-plugin/56371/3 "2006-03-30T17:54:53Z")

</div>

You could also chain a statement for local requests - something like:

if !@requst.ssl? and !@requiest.local  
…

On 3/30/06, Michael G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> On 3/30/06, Peter P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)
> 
> –  
> [http://www.michaelgorsuch.org](http://www.michaelgorsuch.org)

–  
[http://www.michaelgorsuch.org](http://www.michaelgorsuch.org)

---

<div class="post-metadata">

**Author:** ![peterk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/7993a0/32.png) [@peterk](https://www.ruby-forum.com/u/peterk)\
**Post date:** [March 31, 2006, 11:58am UTC](https://www.ruby-forum.com/t/ssl-requirement-plugin/56371/4 "2006-03-31T11:58:38Z")

</div>

Thanks Michael, Are you not using the SSL\_require plugin then, just  
doing your own version, looks pretty stright forward!

---

<div class="post-metadata">

**Author:** ![peterk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/7993a0/32.png) [@peterk](https://www.ruby-forum.com/u/peterk)\
**Post date:** [March 31, 2006, 1:15pm UTC](https://www.ruby-forum.com/t/ssl-requirement-plugin/56371/5 "2006-03-31T13:15:41Z")

</div>

I have similar:

# Adds a filter that requires ssl.

def self.require\_ssl(options={})  
before\_filter :require\_ssl, options  
end

def require\_ssl  
if ENV[‘RAILS\_SSL’] == ‘on’  
request.env[‘HTTPS’] = ‘on’  
raise SSLRequiredError if !request.ssl?  
end  
end

Then in controllers:

require\_ssl :only =\> ‘login’

etc…

This way I can set an environment variable to turn it on or off and  
rather than redirecting it actually raises an exception. Just a  
variation…

On 3/31/06, Peter [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> 

–  
Dan W.  
[http://www.danwebb.net](http://www.danwebb.net)