Question

How do you guys set up your Rails 3.1 app to run HTTP and HTTPS in parallel on production?

Also how do you share the session between HTTP and HTTPS?

Thanks

Answer 1

I use bartt/ssl_requirement which allows you to secure certain actions, like so:

class ApplicationController < ActionController::Base
  include ::SslRequirement
end

class AccountController < ApplicationController
  ssl_required :signup, :payment
  ...
end

For paths, you simply set :secure => true:

<% form_tag session_path(:secure => true), :class => 'home_login' do -%>

To disable in development, add this in the configure block of config/environments/development.rb:

  config.after_initialize do
    SslRequirement.disable_ssl_check = true
  end  

And if you use a secure subdomain like I do on Heroku, you can add this to config/environments/production.rb:

config.after_initialize do
  SslRequirement.ssl_host = 'secure.example.com'
end

as well as :domain => :all to config/initializers/session_store.rb so the session is shared across all domains. e.g.:

MyAppName::Application.config.session_store :cookie_store, key: '_myappname_session', :domain => :all