4 ms·
I would recommend not doing https in rails. I use nginx to switch between http and https when needed. in your nginx config you do this for https setup: # need
by erik_landerholm 16y ago
I would recommend not doing https in rails. I use nginx to switch between http and https when needed.
in your nginx config you do this for https setup:
# needed for HTTPS
proxy_set_header X-FORWARDED-PROTO https;
then if you want, you can check in rails that certain controllers received https requests.
using nginx as proxy means your rails app only ever deals with plain text http.
the only issue, with all http -> https transitions is making sure that things you are storing in sessions are placed in your forms if you go from a http page to an https page on form submission. If not you will lose state if you are storing sessions in the cookies.
The part about relative urls is right. Using cdns etc makes things harder if they don't support your ssl cert.
At CarWoo! once you login we do everything behind https. For our user creation form you can be on an http page, but it submits to https.
We created partials that represent our sign up forms (we have many kinds of landing pages) that automatically take important things out of the session and put them in the form if needed. These things are not security risks, but are important for the correct functionality of the app.
- jashkenas 16y agoSorry -- that's not mentioned in the post, but that's precisely how it works. Nginx handles HTTPS, and Rails only ever sees HTTP, with the "X-FORWARDED-PROTO" header.
- erik_landerholm 16y agoSorry, I didn't get that from the article. I use nginx to do all my redirects to https if someone changes an https link to http. But, that means keeping the nginx config up-to-date.
- metageek 16y agoFrom the article: "Nginx handles the SSL itself, in a straightforward fashion, as long as you’ve compiled it with the SSL module turned on."
- danishkhan 16y agoWhat if you used something like the EnforceSSL Rack Middleware with a Rails application. I feel like that would be a little more useful.
- mukyu 16y agohttps targets for forms on http pages are a security anti-pattern. The Tunisian government keylogged people's Facebook details because of it.
- tptacek 16y agoThis is exactly correct. Security teams at our clients routinely "flunk" applications because they fail to set the "Secure" flag on cookies; this flaw is even worse than that one.
- natrius 16y agoIf you were completely unaware that this happened like I was, here's the story: http://www.theatlantic.com/technology/archive/2011/01/the-inside-story-of-how-facebook-responded-to-tunisian-hacks/70044/ http://www.theatlantic.com/technology/archive/2011/01/the-in... A javascript keylogger was inserted into pages served over plain HTTP. Here's the source: http://www.hackerzvoice.net/node/105 http://www.hackerzvoice.net/node/105 With a little more tact and obfuscation, I bet an attacker could get away would doing that on a large scale for quite some time.