SSL-only, HTTP-only, and mixed

[flivni]

There doesn't seem to be a way to have the following configuration

(1) /admin (SSL Only)
(2) /public (Either SSL or HTTP)
(3) everything else (HTTP only)

Am I missing something?

I think this is a pretty common scenario with Ajax. E.g., this seems to be similar to issue #36.

If I am correct, would it be simpler to get rid of the "strict" option, and instead have a rule-type, i.e. one of {SSL, HTTP, Mixed}?

[flivni]

I noticed that if you have multiple rules, it applies them all, rather than short-circuit. This makes it impossible to have complex rules.

I forked and added support for SSL, HTTP, and mixed, as well as short-circuiting. Not a thing of beauty. Just a quick hack to get me out of the woods.
https://github.com/flivni/rack-ssl-enforcer

Interested in your thoughts.

[tobmatth]

Hey,

sorry for the slow response, i'm neck-deep in work right now and won't be able to take a look at your code before mid next week. Hope that's ok for you...

[flivni]

Hi Tobias,

Take your time! I’m happily using your gem (with my cheap hacks in place).

Cheers.

Felix

From: Tobias Matthies [mailto:[email protected]]
Sent: Tuesday, September 18, 2012 1:54 AM
To: tobmatth/rack-ssl-enforcer
Cc: flivni
Subject: Re: [rack-ssl-enforcer] SSL-only, HTTP-only, and mixed (#39)

Hey,

sorry for the slow response, i'm neck-deep in work right now and won't be able to take a look at your code before mid next week. Hope that's ok for you...

—
Reply to this email directly or view it on GitHub #39 (comment) .

https://github.com/notifications/beacon/Jshd8sI44GVrKZBvymxqKINNQfWrVkrXz00NJx-8EbrCsiasPOwbwn4p5kEjcmHD.gif

[jeffutter]

I wanted to mention this seems to give problems for my use case as well. I want /cart SSL and everything else NOT SSL . However I need to ignore assets so something like:

use Rack::SslEnforcer, :ignore => '/assets'
use Rack::SslEnforcer, :only => '/cart', :strict => true, :force_secure_cookies => false

causes assets to be redirected to http while on /cart. This causes errors in chrome (about insecure items on page).

[rymai]

Hi,

Have you tried use Rack::SslEnforcer, :only => '/cart', :ignore => '/assets, :strict => true, :force_secure_cookies => false?

[jeffutter]

Yes, this results in all /assets being redirected to http:// and thus my css and images don't load when in /cart since the content is insecure.

[rymai]

I'm really not sure about that, I've added a test for your use case and /assets is not redirected as you say it is.

I think that's because you're using a String for the :ignore option where you should use a Regex (as in my "complex example" above) instead in order to match all the assets under the /assets path (and not only the /assets path itself).

Also, please make sure to set the middleware only once, not twice (as in your first example).

[jeffutter]

Oh this does work! Thank you very much. For some reason I was under the assumption that a string got converted to a regex anyhow and would match paths under it.

As for the send bit (only using the middleware once) - I was a little confused on this in the docs as there are no examples that use 2 things (like :only and :ignore) at the same time. There are code boxes though that show multiple lines doing different things.

Anyway, thanks for the pointer.

[rymai]

Thanks for the feedback, I've added a multiple-constraint example in the README!