Ruby on Rails: ssl_required: how do I enable on the entire app?

Question

Is there an easy way to enable SSL on the entire app?

I'm using rails 2.3.8

Answer 1

By default, all of your controllers should inherit from ApplicationController.

ssl_required is actually backed by a protected method called ssl_required? which determines whether SSL is required for a given action. This implementation will make SSL always required in the production environment (but not otherwise, so you can still do development as usual).

class ApplicationController < ActionController::Base
  # (... other stuff ...)

  protected

  def ssl_required?
    Rails.env.production?
  end
end

Depending on your environment, it may also be possible for the upstream server to only be available via HTTPS (e.g. if you're using Apache, you could configure it not to serve your application over port 80). This depends on your server setup.

Answer 2

In Rails 5 you can do this in your application configuration:

So if you want to disable it for your entire application you can just add this to your config/application.rb:

...
config.force_ssl = true
...

Or if you want to configure it differently for different environments:

config/production.rb

...
config.force_ssl = true
...

config/development.rb

...
config.force_ssl = false
...