# Using mongrel and want whole site ssl

**URL:** <https://www.ruby-forum.com/t/using-mongrel-and-want-whole-site-ssl/81731>\
**Category:** Rails\
**Created:** [January 12, 2007, 3:32am UTC](https://www.ruby-forum.com/t/using-mongrel-and-want-whole-site-ssl/81731 "2007-01-12T03:32:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![yardboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/9de0a6/32.png) [@yardboy](https://www.ruby-forum.com/u/yardboy)\
**Post date:** [January 12, 2007, 3:32am UTC](https://www.ruby-forum.com/t/using-mongrel-and-want-whole-site-ssl/81731/1 "2007-01-12T03:32:38Z")

</div>

Hi:

I don’t have access to change the apache configuration on my hosted  
server account (ie, install and use mod\_header to do this as documented  
elsewhere). My entire site needs to be under ssl, so I want anyone  
coming to [Custom Application Development Software for Business - Salesforce.com](http://www.site.com/whatever/blah) to route or redirect to  
[Custom Application Development Software for Business - Salesforce.com](https://www.site.com/whatever/blah).

I added the following to my application controller:

before\_filter :set\_ssl  
def set\_ssl  
request.env[“HTTPS”] = “on”  
end

My default route goes to :controller =\> ‘website’.

This code in the application controller has the intended effect when I  
navigate to [http://www.site.com](http://www.site.com) - that is, I end up at  
[Custom Application Development Software for Business - Salesforce.com](https://www.site.com/website/index).

However, when I navigate to [Custom Application Development Software for Business - Salesforce.com](http://www.site.com/website/index), it  
doesn’t redirect to the https protocol - I end up at  
[Custom Application Development Software for Business - Salesforce.com](http://www.site.com/website/index).

Can anyone help me out and explain why the code I put in fires for the  
root of the site but not for a more specific url? Or… anyone have  
other ideas or solutions that are accomplished via code completely  
within my rails application? Is there a way to do this with routes?

Thanks.  
c.

---

<div class="post-metadata">

**Author:** ![yardboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/9de0a6/32.png) [@yardboy](https://www.ruby-forum.com/u/yardboy)\
**Post date:** [January 12, 2007, 4:27am UTC](https://www.ruby-forum.com/t/using-mongrel-and-want-whole-site-ssl/81731/2 "2007-01-12T04:27:54Z")

</div>

Cayce B. wrote:

> Hi:
> 
> I don’t have access to change the apache configuration on my hosted  
> server account (ie, install and use mod\_header to do this as documented  
> elsewhere). My entire site needs to be under ssl, so I want anyone  
> coming to [Custom Application Development Software for Business - Salesforce.com](http://www.site.com/whatever/blah) to route or redirect to  
> [Custom Application Development Software for Business - Salesforce.com](https://www.site.com/whatever/blah).
> 
> I added the following to my application controller:
> 
> before\_filter :set\_ssl  
> def set\_ssl  
> request.env[“HTTPS”] = “on”  
> end
> 
> My default route goes to :controller =\> ‘website’.
> 
> This code in the application controller has the intended effect when I  
> navigate to [http://www.site.com](http://www.site.com) - that is, I end up at  
> [Custom Application Development Software for Business - Salesforce.com](https://www.site.com/website/index).
> 
> However, when I navigate to [Custom Application Development Software for Business - Salesforce.com](http://www.site.com/website/index), it  
> doesn’t redirect to the https protocol - I end up at  
> [Custom Application Development Software for Business - Salesforce.com](http://www.site.com/website/index).
> 
> Can anyone help me out and explain why the code I put in fires for the  
> root of the site but not for a more specific url? Or… anyone have  
> other ideas or solutions that are accomplished via code completely  
> within my rails application? Is there a way to do this with routes?
> 
> Thanks.  
> c.

You would be better of just redirecting, rather than just changing the  
env variables on the server as HTTPS setup requires the browser and  
server negotiation.

application\_controller.rb

before\_filter :redirect\_to\_ssl  
def redirect\_to\_ssl  
redirect\_to :protocol =\> “https://” unless (@request.ssl? or  
local\_request?)  
end

(after  
[http://www.busyashell.com/blog/articles/2006/10/20/how-to-force-https-without-a-host-in-rails](http://www.busyashell.com/blog/articles/2006/10/20/how-to-force-https-without-a-host-in-rails))

---

<div class="post-metadata">

**Author:** ![yardboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/9de0a6/32.png) [@yardboy](https://www.ruby-forum.com/u/yardboy)\
**Post date:** [January 12, 2007, 5:27am UTC](https://www.ruby-forum.com/t/using-mongrel-and-want-whole-site-ssl/81731/3 "2007-01-12T05:27:22Z")

</div>

> You would be better of just redirecting, rather than just changing the  
> env variables on the server as HTTPS setup requires the browser and  
> server negotiation.
> 
> application\_controller.rb
> 
> before\_filter :redirect\_to\_ssl  
> def redirect\_to\_ssl  
> redirect\_to :protocol =\> “https://” unless (@request.ssl? or  
> local\_request?)  
> end
> 
> (after  
> [http://www.busyashell.com/blog/articles/2006/10/20/how-to-force-https-without-a-host-in-rails](http://www.busyashell.com/blog/articles/2006/10/20/how-to-force-https-without-a-host-in-rails))

I appreciate the idea and the link. However, that puts my site in a loop  
that fails after a second or two with a “The page isn’t redirection  
properly” error. FYI I’m using login\_engine and user\_engine on this  
site, not sure if that affects anything, but there are a couple of other  
before\_filters relating to authorizing the action and logging in via  
cookie.

Any ideas?

tks.

---

<div class="post-metadata">

**Author:** ![yardboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/9de0a6/32.png) [@yardboy](https://www.ruby-forum.com/u/yardboy)\
**Post date:** [January 13, 2007, 5:50pm UTC](https://www.ruby-forum.com/t/using-mongrel-and-want-whole-site-ssl/81731/4 "2007-01-13T17:50:36Z")

</div>

Andrew S. wrote:

> Cayce B. wrote:
> 
> > I appreciate the idea and the link. However, that puts my site in a loop  
> > that fails after a second or two with a “The page isn’t redirection  
> > properly” error. FYI I’m using login\_engine and user\_engine on this  
> > site, not sure if that affects anything, but there are a couple of other  
> > before\_filters relating to authorizing the action and logging in via  
> > cookie.
> > 
> > Any ideas?
> > 
> > tks.
> 
> Hmmm.
> 
> Sounds like it’s doing too many redirects. Does the page your visiting  
> require login to access?
> 
> I am not familiar with engines (yet), so can’t help there…

That page, no - other pages on the site yes. In any case - I have  
something to research - I appreciate you getting me headed in a better  
direction.

c.

---

<div class="post-metadata">

**Author:** ![yardboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/9de0a6/32.png) [@yardboy](https://www.ruby-forum.com/u/yardboy)\
**Post date:** [January 12, 2007, 5:43am UTC](https://www.ruby-forum.com/t/using-mongrel-and-want-whole-site-ssl/81731/5 "2007-01-12T05:43:45Z")

</div>

Cayce B. wrote:

> I appreciate the idea and the link. However, that puts my site in a loop  
> that fails after a second or two with a “The page isn’t redirection  
> properly” error. FYI I’m using login\_engine and user\_engine on this  
> site, not sure if that affects anything, but there are a couple of other  
> before\_filters relating to authorizing the action and logging in via  
> cookie.
> 
> Any ideas?
> 
> tks.

Hmmm.

Sounds like it’s doing too many redirects. Does the page your visiting  
require login to access?

I am not familiar with engines (yet), so can’t help there…

---

<div class="post-metadata">

**Author:** ![yardboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/9de0a6/32.png) [@yardboy](https://www.ruby-forum.com/u/yardboy)\
**Post date:** [January 19, 2007, 4:31pm UTC](https://www.ruby-forum.com/t/using-mongrel-and-want-whole-site-ssl/81731/6 "2007-01-19T16:31:20Z")

</div>

If you’re on shared hosting, it may be difficult to add the https,  
since by nature https encrypts at the server/port level.

see: [SSL/TLS Strong Encryption: FAQ - Apache HTTP Server](http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#vhosts2)

on why it’s impossible to do use Name-Based Virtual Hosting to  
identify different SSL virtual hosts. unless you’re the only one on  
that box or have a separate IP and the host isn’t currently using port  
443…

–  
Charles Brian Q.  
self-promotion: [www.seebq.com](http://www.seebq.com)  
highgroove studios: [www.highgroove.com](http://www.highgroove.com)  
slingshot hosting: [www.slingshothosting.com](http://www.slingshothosting.com)  
678.389.9462

Ruby on Rails Bootcamp at the Big Nerd Ranch  
Intensive Ruby on Rails Training:  
[http://www.bignerdranch.com/classes/ruby.shtml](http://www.bignerdranch.com/classes/ruby.shtml)

---

<div class="post-metadata">

**Author:** ![yardboy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/9de0a6/32.png) [@yardboy](https://www.ruby-forum.com/u/yardboy)\
**Post date:** [January 20, 2007, 1:29am UTC](https://www.ruby-forum.com/t/using-mongrel-and-want-whole-site-ssl/81731/7 "2007-01-20T01:29:22Z")

</div>

Charles Brian Q. wrote:

> If you’re on shared hosting, it may be difficult to add the https,  
> since by nature https encrypts at the server/port level.

Understood, as such this host requires a dedicated IP when you get your  
SSL certificate.

Update - per my host tech support, the reason this is happening is that  
Apache proxies all requests - http:// and https:// - to Mongrel using  
http:// protocol. So - Mongrel and subsequently rails has no idea which  
session is SSL unless you use a header rewrite to add a flag for rails  
to know it’s ssl (this is the solution documented elsewhere on the web).

Thanks for assistance, all.

c.