Accept only HTTPS requests in Ruby on Rails

Question

For the some actions, I would like to accept only HTTPS request.
This is my first code, but I think there is a better way.

before_filter :reject_http_request, :only => [:fucntion_a, :function_b]

def reject_http_request
  scheme = request.protocol.to_s.downcase
  if scheme == 'http://'
    raise AccessDeniedException.new("Not allowed protocol scheme")
  end
  true
end

How can I improve this code?

Answer 1

You can do this at the Rack level with the rack-ssl-enforcer gem. It's configurable to allow exclusion of specific paths, hosts, and methods.

If it meets your needs, I'd recommend doing this over rolling your own solution. We currently use it in production and it works great.

Answer 2

For forcing SSL for a particular action, you can use force_ssl.
For the entire app, you can just do: config.force_ssl = true in your environment.rb file.
Read more here.