Rails 3 SSL弃用

config/routes.rb

MyApplication::Application.routes.draw do
  resources :sessions, :constraints => { :protocol => "https" }
end

或者,如果需要对多个路由强制SSL:

MyApplication::Application.routes.draw do
  scope :constraints => { :protocol => "https" } do 
    # All your SSL routes.
  end
end

链接到SSL路由可以这样做:

<%= link_to "Logout", sessions_url(:protocol => 'https'), :method => :delete %>

# Redirect /foos and anything starting with /foos/ to https.
match "foos(/*path)", :to => redirect { |_, request|
  "https://" + request.host_with_port + request.fullpath }

在花了一个下午寻找最佳解决方案之后,我决定采用本文中描述的方法: http://clearcove.ca/blog/2010/11/how-to-secure-a-rails-app-on-heroku-with-ssl-firesheep/ Force SSL using ssl_requirement in Rails 2 app

基本上是这样:

# lib/middleware/force_ssl.rb
class ForceSSL
  def initialize(app)
    @app = app
  end

  def call(env)
    if env['HTTPS'] == 'on' || env['HTTP_X_FORWARDED_PROTO'] == 'https'
      @app.call(env)
    else
      req = Rack::Request.new(env)
      [301, { "Location" => req.url.gsub(/^http:/, "https:") }, []]
    end
  end
end

# config/application.rb
config.autoload_paths += %W( #{ config.root }/lib/middleware )

# config/environments/production.rb
config.middleware.use "ForceSSL"

在*应用程序/控制器/您的_控制器.rb*

 class LostPasswordsController < ApplicationController

   force_ssl

   def index
     #....
   end
 end 

http://apidock.com/rails/ActionController/ForceSSL/ClassMethods/force_ssl

在以后的Rails(至少3.12+)中,您可以使用以下特定于环境的功能:

在配置/环境中/生产.rb(或其他环境)

# Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
config.force_ssl = true