3 ms·
It's worth noting that Rails enables HSTS for the whole domain when you use the following in one of your config files (usually production.rb): config.force
by mguillemot 14y ago
It's worth noting that Rails enables HSTS for the whole domain when you use the following in one of your config files (usually production.rb):
config.force_ssl = true
- ch0wn 14y agoAnd for Flask users there is flask-sslify[0] by Kenneth Reitz for this. [0] https://github.com/kennethreitz/flask-sslify https://github.com/kennethreitz/flask-sslify
- Kudos 14y agoI presume something like this is only useful for services like Heroku where you can't set it in your webserver directly?
- MichaelGG 14y agoIt's also useful if your app requirements trump deployment requirements. You might want a particular app to always require SSL, regardless of how it is deployed.