Rails image and tracking protection

Question

I have made a sample app with devise and facebook auth. I want to show fb profile photo as the user's avatar and it's working in chrome and IE. But in firefox I see the warning about 'Tracking Protection' - 'Connection is not secure'.

I wrote a simple method:

def avatar_for(user)
  avatar_url = user.image
  image_tag(avatar_url, alt: user.name, class: "avatar") unless user.image.nil?
end

How can I make such a method/connection safe?

EDIT: It's exactly how max wrote: using https address vis secure_image_url removes the warning in 'Tracking Protection' warning in Firefox, but no image is displayed.

Answer 1

Use the secure_image_url option to have OmniAuth Facebook create a HTTPS address instead:

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :facebook, ENV['FACEBOOK_KEY'], ENV['FACEBOOK_SECRET'],
    secure_image_url: true
end