What does force_ssl do in Rails?

ruby-on-rails ssl nginx
user782220 picture user782220 · Mar 28, 2013 · Viewed 54.9k times · Source

In a previous question I found out that I should be setting nginx ssl termination and not having Rails process encrypted data.

Then why does the following exist?

config.force_ssl = true

I see this commented out in the production config file. But if the expectation is that nginx will handle all the ssl stuff so that my rails app doesn't deal with encrypted data then what does config.force_ssl = true do?

Should I leave it commented out in production if I know I will always be using nginx?

Answer

Dan Jameson picture Dan Jameson · Nov 4, 2014

It doesn't just force your browser to redirect HTTP to HTTPS. It also sets your cookies to be marked "secure", and it enables HSTS, each of which are very good protections against SSL stripping.

Even though HTTPS protects your app at "https://example.com/yourapp" against MITM attacks, if someone gets between your client and your server they can rather easily get you to visit "http://example.com/yourapp". With neither of the above protections, your browser will happily send the session cookie to the person doing the MITM.

Related questions

Why am I getting infinite redirect loop with force_ssl in my Rails app?

I want to have my API controller use SSL, so I added another listen directive to my nginx.conf upstream unicorn { server unix:/tmp/unicorn.foo.sock fail_timeout=0; } server { listen 80 default deferred; listen 443 ssl default; ssl_certificate /etc/ssl/…

Read More
How do I setup ssl on a rails 4 app? (nginx + passenger)

I have a staging rails app running with passenger on nginx. I want to secure the connections with SSL. I have read a lot of resources online but I have yet to make it run on SSL. So far, my …

Read More
Rails 4 + nginx + unicorn + ssl = 502 Bad Gateway

Browser is showing 502 Bad Gateway - nginx. The only good news is my SSL https and green lock is showing up. Nginx Logs Error below nginx/error.log *1 connect() failed (111: Connection refused) while connecting to upstream, client: xx.xxx.xx.…

Read More