Rails 4 force_ssl issue?

Question

Testing Rails 4. In Rails 3, putting force_ssl at the top of my controller forced ssl only for production. This was ignored for development, which was the behavior I wanted, and which conformed to the docs for force_ssl.

In Rails 4 I found that force_ssl forces ssl even for development, which is not the behavior I want (easy to work around, but requires more code which I don't want). Furthermore, I can't find where this was supposedly changed in any release notes, so I believe it could be a bug.

I haven't been able to find a bug report on this through googling, nor on this website. Can anyone else confirm? Furthermore, if so, can someone submit the bug report to Rails (I don't have an account set up to do so, and don't want to create one if someone else already has one).

Easy workaround, btw:

Rails.env.production? ? force_ssl : nil

Answer 1

It's not a bug- https://github.com/rails/rails/pull/5023

The solution given there for your issue is

force_ssl unless Rails.env.development?

Answer 2

If, like me, you have force_ssl a lot of places in your code you can keep DRY with an initializer:

module ActionController::ForceSSL::ClassMethods
  alias_method :original_force_ssl, :force_ssl
  def force_ssl(options={})
    original_force_ssl unless Rails.env.development?
  end
end