aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib/action_controller/metal/force_ssl.rb
Commit message (Collapse)AuthorAgeFilesLines
* Revert ensure external redirects are explicitly allowedGannon McGibbon2019-01-221-2/+1
|
* Ensure external redirects are explicitly allowedGannon McGibbon2019-01-171-2/+3
| | | | Add `fallback_location` and `allow_other_host` options to `redirect_to`.
* Permit list usage cleanup and clearer documentationKevin Deisz2018-08-271-2/+2
|
* Convert over the rest of the whitelist referencesKevin Deisz2018-08-241-1/+1
|
* Deprecate controller level force_sslDerek Prior2018-03-301-55/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Today there are two common ways for Rails developers to force their applications to communicate over HTTPS: * `config.force_ssl` is a setting in environment configurations that enables the `ActionDispatch::SSL` middleware. With this middleware enabled, all HTTP communication to your application will be redirected to HTTPS. The middleware also takes care of other best practices by setting HSTS headers, upgrading all cookies to secure only, etc. * The `force_ssl` controller method redirects HTTP requests to certain controllers to HTTPS. As a consultant, I've seen many applications with misconfigured HTTPS setups due to developers adding `force_ssl` to `ApplicationController` and not enabling `config.force_ssl`. With this configuration, many application requests can be served over HTTP such as assets, requests that hit mounted engines, etc. In addition, because cookies are not upgraded to secure only in this configuration and HSTS headers are not set, it's possible for cookies that are meant to be secure to be sent over HTTP. The confusion between these two methods of forcing HTTPS is compounded by the fact that they share an identical name. This makes finding documentation on the "right" method confusing. HTTPS throughout is quickly becomming table stakes for all web sites. Sites are expected to operate over HTTPS for all communication, sensitive or otherwise. Let's encourage use of the broader-reaching `ActionDispatch::SSL` middleware and elminate this source of user confusion. If, for some reason, applications need to expose certain endpoints over HTTP they can do so by properly configuring `config.ssl_options`.
* Fix typos, update documentationJames Lovejoy2018-01-111-2/+2
| | | | [ci skip]
* Use frozen string literal in actionpack/Kir Shatrov2017-07-291-0/+2
|
* Revert "Merge pull request #29540 from kirs/rubocop-frozen-string"Matthew Draper2017-07-021-1/+0
| | | | | This reverts commit 3420a14590c0e6915d8b6c242887f74adb4120f9, reversing changes made to afb66a5a598ce4ac74ad84b125a5abf046dcf5aa.
* Enforce frozen string in RubocopKir Shatrov2017-07-011-0/+1
|
* Fix HTTPS grammarJon Moss2017-03-131-4/+4
| | | | [ci skip]
* [docs] fix ActionController documentationHrvoje Šimić2017-03-121-4/+4
| | | | [ci skip]
* Fix a force ssl redirection bug that occur when session store disabled.Taishi Kasuga2016-11-221-1/+1
|
* modernizes hash syntax in actionpackXavier Noria2016-08-061-4/+4
|
* applies new string literal convention in actionpack/libXavier Noria2016-08-061-3/+3
| | | | | The current code base is not uniform. After some discussion, we have chosen to go with double quotes by default.
* Actionpack documentation typos [ci skip]Tom Kadwill2016-04-231-4/+4
|
* Fix formatting of force_ssl options documentation [ci skip]Eliot Sykes2015-07-191-6/+6
|
* Revert "Merge pull request #19682 from ↵Santiago Pastorino2015-04-121-1/+1
| | | | | | | supercaracal/fix_force_ssl_redirection_flash_error" This reverts commit d215620340be7cb29e2aa87aab22da5ec9e6e6a7, reversing changes made to bbbbfe1ac02162ecb5e9a7b560134a3221f129f3.
* fix fails to force_ssl_redirection if session_store is disabledTaishi Kasuga2015-04-091-1/+1
|
* just set the host, no need for another hash allocation / merge!Aaron Patterson2014-08-011-1/+1
|
* Fix a few typos. [ci skip]namusyaka2013-09-041-1/+1
|
* Don't reprocess the options hash on every requestAndrew White2013-04-271-1/+2
|
* Add support for extra options to `force_ssl`Andrew White2013-04-251-17/+48
| | | | | | | | This commit adds support for passing additional url options along with a :status option and any of the flash-related options to `redirect_to` (i.e. :flash, :alert & :notice). Closes #7570.
* Use `request.fullpath` to build redirect url in `force_ssl`Andrew White2013-04-251-4/+7
| | | | | | | | | | | The `force_ssl` command now builds the redirect url from `request.fullpath`. This ensures that the format is maintained and it doesn't redirect to a route that has the same parameters but is defined earlier in `routes.rb`. Also any optional segments are maintained. Fixes #7528. Fixes #9061. Fixes #10305.
* update documentation and code to use _action callbacksFrancesco Rodriguez2012-12-071-2/+2
|
* Multiple changes to 1,9 hash syntaxAvnerCohen2012-10-271-1/+1
|
* Missing closing tagEllis Berner2012-08-121-1/+1
|
* Extracted redirect logic from ActionController::Force::ClassMethods.force_sslJeremy Friesen2012-05-311-7/+15
| | | | | | | | | | | | | Prior to this patch the existing .force_ssl method handles both defining the filter and handling the logic for performing the redirect. With this patch the logic for redirecting to the HTTPS protocol is separated from the filter logic that determines if a redirect should occur. By separating the two levels of behavior, an instance method for ActionController (i.e. #force_ssl_redirect) is exposed and available for more granular SSL enforcement. Cleaned up indentation.
* Add ActionController::HTTPSantiago Pastorino2012-03-141-1/+1
| | | | | | More info http://edgeguides.rubyonrails.org/api_app.html [Carlos Antonio da Silva & Santiago Pastorino]
* Document the :host option for force_sslAndrew White2012-02-231-0/+1
|
* Update documentation for force_ssl - closes #5023.Andrew White2012-02-231-1/+14
|
* SSL should not be disabled by default in any environment.Pat Allan2012-02-231-1/+1
|
* Fixed force_ssl redirects to include original query paramsRyan McGeary2012-02-071-0/+1
| | | | | | | | | | `ActionController.force_ssl` redirects http URLs to their https equivalent; however, when a URL contains a query string, the resulting redirect lacked the original query string. Conflicts: actionpack/lib/action_controller/metal/force_ssl.rb
* When force redirecting to SSL, make sure that the session is kept. As we're ↵Marcin Bunsch and Przemek Dąbek2012-01-121-0/+1
| | | | moving from a non-secure to secure environment, it's safe
* accept optional :host parameter to force_sslBen Scheirman2011-10-081-2/+5
|
* fix minor spelling mistakes in commentsDmytrii Nagirniak2011-05-231-3/+3
|
* Add controller-specific `force_ssl` method to force web browser to use HTTPS ↵Prem Sichanugrist2011-03-281-0/+35
protocol This would become useful for site which sometime transferring sensitive information such as account information on particular controller or action. This featured was requested by DHH.
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-03 10:11:55 +0000