# Web Service behind https

**URL:** <https://www.ruby-forum.com/t/web-service-behind-https/122162>\
**Category:** Rails\
**Created:** [December 5, 2007, 1:34am UTC](https://www.ruby-forum.com/t/web-service-behind-https/122162 "2007-12-05T01:34:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![paul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbe5ce/32.png) [@paul](https://www.ruby-forum.com/u/paul)\
**Post date:** [December 5, 2007, 1:34am UTC](https://www.ruby-forum.com/t/web-service-behind-https/122162/1 "2007-12-05T01:34:37Z")

</div>

Hi,

I’m trying to create a web service that runs on https (i.e ssl). I  
have install the ssl\_requirement plugin and in my webservice  
controller I have the lines

ssl\_required :method\_name

In development I had this commented out, as I wasn’t running https  
locally. When I called MethodName it worked fine (in development).

But in production with ssl when I call the method.  
It returns a 302

When I check the production logs I see the following:

Redirected to http://…myurl…  
Filter chain halted as  
[#\<ActionController::Filters::ClassMethods::SymbolFilter:0xb759fb34  
@filter=:ensure\_proper\_protocol\>] returned false.  
Completed in 0.00029 (3506 reqs/sec) | DB: 0.00000 (0%) | 302 Found  
[https://…myurl…]

Am I doing somethign horribly wrong? Any suggestions?

Just in case it helps I am also using ssl\_required in some other  
controllers and it’s working as I’d expect there.

Thanks (in advance) for any help

Regards,

Paul

---

<div class="post-metadata">

**Author:** ![paul](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/bbe5ce/32.png) [@paul](https://www.ruby-forum.com/u/paul)\
**Post date:** [December 5, 2007, 2:55pm UTC](https://www.ruby-forum.com/t/web-service-behind-https/122162/2 "2007-12-05T14:55:25Z")

</div>

Paul,

We’d need to know more about your production environment to help  
further, but a very common problem is between the https server and  
your application. The https server usually needs to include some kind  
of header so Rails knows that it’s talking https. If you’re using  
Apache to talk to a Mongrel server (for example), you need to include  
the X\_FORWARDED\_PROTO header in the virtual host directive for your  
production server (and make sure your SSLEngine is turned on).

Below is a snippet of configuration I use on my development machine.  
In production you probably wouldn’t want to use ProxyPass – it would  
be better to use something like mod\_balance against a cluster of  
Mongrels.

\<VirtualHost \*:443\>  
SSLEngine On  
ServerName localhost  
ServerAlias 127.0.0.1

ProxyPass / [http://localhost:3000/](http://localhost:3000/)  
ProxyPassReverse / [http://localhost:3000](http://localhost:3000)  
ProxyPreserveHost on  
RequestHeader set X\_FORWARDED\_PROTO ‘https’

By the way, it’s pretty easy to set up your own https server in  
development, which is better than commenting things out. I wrote up a  
quick article about it here:

[http://www.subelsky.com/2007/11/testing-rails-ssl-requirements-on-your.html](http://www.subelsky.com/2007/11/testing-rails-ssl-requirements-on-your.html)

Also helpful were these articles, which have lots of good information  
even if you’re not using Mongrel:

[http://blog.innerewut.de/2006/06/21/mongrel-and-rails-behind-apache-2-2-and-ssl](http://blog.innerewut.de/2006/06/21/mongrel-and-rails-behind-apache-2-2-and-ssl)  
[http://mongrel.rubyforge.org/docs/apache.html](http://mongrel.rubyforge.org/docs/apache.html)

-Mike Subelsky

> **[Mike Subelsky: Programmer / Mentor / Entrepreneur](https://www.subelsky.com/)**
>
> Personal website of Mike Subelsky: programmer, mentor, and entrpreneur based in Baltimore, Maryland