# Ssl\_requirement redirecting to http from an https screen

**URL:** <https://www.ruby-forum.com/t/ssl-requirement-redirecting-to-http-from-an-https-screen/90582>\
**Category:** Rails\
**Created:** [March 30, 2007, 1:24am UTC](https://www.ruby-forum.com/t/ssl-requirement-redirecting-to-http-from-an-https-screen/90582 "2007-03-30T01:24:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Noah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/a87d85/32.png) [@Noah](https://www.ruby-forum.com/u/Noah)\
**Post date:** [March 30, 2007, 1:24am UTC](https://www.ruby-forum.com/t/ssl-requirement-redirecting-to-http-from-an-https-screen/90582/1 "2007-03-30T01:24:13Z")

</div>

I installed the ssl\_requirement plugin & got it working w/my server  
(lighty scgi) without too much difficulty.

I have some pages that require ssl (login for example) and some pages  
that do not. My problem is that once the site’s been redirected to an  
ssl\_required action, I don’t seem to be able to redirect back to a  
non-ssl required page.

From some of the searching I’ve done on Google, it seems that the  
expectation is that once you’ve switched over to an ssl page, you’re not  
supposed to go back. I think this is a major hassle as it means that I  
have to mark every action in my controllers w/the ssl\_allowed parameter  
and I have a lot of them.

Is there someone out there who knows how to make this work?

Thx  
Noah

---

<div class="post-metadata">

**Author:** ![Noah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/a87d85/32.png) [@Noah](https://www.ruby-forum.com/u/Noah)\
**Post date:** [March 30, 2007, 2:13am UTC](https://www.ruby-forum.com/t/ssl-requirement-redirecting-to-http-from-an-https-screen/90582/2 "2007-03-30T02:13:32Z")

</div>

On Mar 29, 2007, at 7:24 PM, Noah wrote:

> you’re not  
> supposed to go back. I think this is a major hassle as it means  
> that I  
> have to mark every action in my controllers w/the ssl\_allowed  
> parameter  
> and I have a lot of them.
> 
> Is there someone out there who knows how to make this work?

If you meant that you want some actions to only be accessed over  
http, you might want to do something like the following:

class MyController \< ApplicationController  
before\_filter :redirect\_to\_http, :except =\> :my\_ssl\_action

def redirect\_to\_http  
redirect\_to :protocol =\> “http://” and return false if  
@request.ssl?  
end

end

James.

–  
James S.  
Play: [http://james.anthropiccollective.org](http://james.anthropiccollective.org)  
Work: [http://jystewart.net/process/](http://jystewart.net/process/)

---

<div class="post-metadata">

**Author:** ![Noah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/a87d85/32.png) [@Noah](https://www.ruby-forum.com/u/Noah)\
**Post date:** [March 30, 2007, 4:07am UTC](https://www.ruby-forum.com/t/ssl-requirement-redirecting-to-http-from-an-https-screen/90582/3 "2007-03-30T04:07:55Z")

</div>

Thanks for the reply James, but the ssl\_requirement already contains  
this.

def ensure\_proper\_protocol  
return true if ssl\_allowed?  
if ssl\_required? && !request.ssl?  
redirect\_to “https://” + request.host + request.request\_uri  
return false  
elsif request.ssl? && !ssl\_required?  
redirect\_to “http://” + request.host + request.request\_uri  
return false  
end  
end

I put some debug statments in the code and got this in my log:  
ssl\_required? && !ssl\_required? evaluated to true =\> /login/signin  
Redirected to [http://localhost/login/signin](http://localhost/login/signin)

So Rails seems to be intercepting it properly, the problem is that in my  
browser, the url is this: [https://localhost/login/signin](https://localhost/login/signin)

Somehow, (in Lighty maybe?) it never gets changed.

But thanks for the suggestion.

Noah

James S. wrote:

> On Mar 29, 2007, at 7:24 PM, Noah wrote:
> 
> > you’re not  
> > supposed to go back. I think this is a major hassle as it means  
> > that I  
> > have to mark every action in my controllers w/the ssl\_allowed  
> > parameter  
> > and I have a lot of them.
> > 
> > Is there someone out there who knows how to make this work?
> 
> If you meant that you want some actions to only be accessed over  
> http, you might want to do something like the following:
> 
> class MyController \< ApplicationController  
> before\_filter :redirect\_to\_http, :except =\> :my\_ssl\_action
> 
> def redirect\_to\_http  
> redirect\_to :protocol =\> “http://” and return false if  
> @request.ssl?  
> end
> 
> end
> 
> James.
> 
> –  
> James S.  
> Play: [http://james.anthropiccollective.org](http://james.anthropiccollective.org)  
> Work: [http://jystewart.net/process/](http://jystewart.net/process/)