Question

I want to protect the login form of my Rails application using HTTPS. After a bit of a uphill struggle I now have the SSL certificate installed and Apache/Passenger set up correctly.

My application uses SSL Requirement and RESTful Authentication in combination for the login form. I’ve noticed using Firebug that the login credentials are still sent in the clear. How can I make the Rails form_tag helper submit the form over HTTPS? I couldn’t see anything about this in the docs.

---

EDIT: I did some more research and edited my routes file so that the session controller uses HTTPS:

map.resource :session, :controller => 'session',
                       :only => [:new, :create, :destroy],
                       :requirements => { :protocol => 'https' }

I also changed the login form to use session_url instead of session_path:

<% form_tag session_url do %>
  .
  .
  .
<% end %>

—This is correctly using a full https:// URL as the action for the generated form element, but I can still sniff the user name and password using Firebug. What’s going on?!

Thanks.

Answer 1

Since Firebug is an extension inside Firefox it probably sees the request data before it gets encrypted. If you want to test this properly you should use a tool outside of Firefox.