Rack::SslEnforcer options mess up with 'localhost'

[hammady]

Whatever options you put like :only_environments => 'production' or :only_hosts => 'blahblah', these will NOT be respected if you use 'localhost'. However, using 127.0.0.1 will behave correctly!

[tobmatth]

Thanks for reporting, i'll take a look this evening. Could you provide a failing test case?

[hammady]

I will try if I have time. Thanks for your help.

[hammady]

I created 2 cases for localhost and 127.0.0.1 but they both succeed. However, in the real environment where many layers are involved (DNS, thin/webrick/apache, ...) are involved, I am not sure how to reproduce this using your simple test environment. Maybe capybara with selenium should be used to replicate this?

[tobmatth]

Ok. What's the config.middleware.use line you use?

[hammady]

config.middleware.use Rack::SslEnforcer,
  :only_environments => 'production',
  :only_hosts => 'PRODUCTION_HOST',
  :only => [%r{^/users}, %r{^/admin}],
  :except => '/users/sign_out',
  :strict => true

[tobmatth]

Sorry for the response lag, i've been pretty busy the last days.

config.middleware.use Rack::SslEnforcer,
  :only_environments => 'production',
  :only_hosts => 'www.example.org',
  :only => [%r{^/users}, %r{^/admin}],
  :except => '/users/sign_out',
  :strict => true

With the configuration line above, there should be no redirects at all in development environment, no matter if you point your browser to http://localhost/users or http://127.0.0.1/users. If i understand your issue properly, you are being redirected anyway?

[hammady]

I get redirected if used localhost but not 127.0.0.1.

Sent from my iPhone

On Dec 2, 2013, at 10:22 PM, Tobias Matthies [email protected] wrote:

Sorry for the response lag, i've been pretty busy the last days.

config.middleware.use Rack::SslEnforcer,
:only_environments => 'production',
:only_hosts => 'www.example.org',
:only => [%r{^/users}, %r{^/admin}],
:except => '/users/sign_out',
:strict => true
With the configuration line above, there should be no redirects at all in development environment, no matter if you point your browser to http://localhost/users or http://127.0.0.1/users. If i understand your issue properly, you are being redirected anyway?

—
Reply to this email directly or view it on GitHub.

[tobmatth]

I've prepared a little sample application, which behaves as expected (from my side). Could you checkout https://github.com/tobmatth/rse-gh64 and test if this works for you?

[tobmatth]

Closing here due to inactivity, feel free to reopen...

[hammady]

It works perfectly. For my app as well. My best guess is that zeus could have had problems reloading the middleware.

[tobmatth]

Good to hear and thanks for your feedback...