panmind / ssl_helper Goto Github PK

There's an issue with redirect that happen due to either require_ssl or refuse_ssl when the request is coming is not a GET one.
All params are given to redirect_to, this results in all fields being put in querystring on the destination page. This is obviously a security issue and needs to be fixed. A form should not know in advance if the destination resource accepts or refuses SSL.

ssl_requirement makes me include SSLRequirment in the application controller.

I thought this was similar, but no such luck with that code in the app controller.

Am I missing something, how does this work? Does just including the gem make it work (i.e., redirect from http to https for certain controller actions? if so how?

any guidance is appreciated.

Hey,

ok, in the Server configuration section, you mention adding the X-PROTO line in a location...

but you have that location as / or root, will that work throughout the whole site? and subdomains, and everything?

my nginx fu is weak, but I too am using it. I've not had much luck on google so thought I'd ask.

Once i get this up, i may add to your README or put up an article in your wiki for guys who need more hand holding like me.