123456789_123456789_123456789_123456789_123456789_

Module: ActionController::ForceSSL

Relationships & Source Files
Namespace Children
Modules:
ClassMethods
Extension / Inclusion / Inheritance Descendants
Included In:
API, Base, ::ActionView::TestCase::TestController, Rails::ApplicationController, Rails::InfoController, Rails::MailersController, Rails::WelcomeController
Super Chains via Extension / Inclusion / Inheritance
Class Chain:
self, ::ActiveSupport::DescendantsTracker, ::ActiveSupport::Concern
Instance Chain:
self, ::AbstractController::Callbacks, ::ActiveSupport::Callbacks
Defined in: actionpack/lib/action_controller/metal/force_ssl.rb

Overview

This module provides a method which will redirect the browser to use the secured HTTPS protocol. This will ensure that users’ sensitive information will be transferred safely over the internet. You should always force the browser to use HTTPS when you’re transferring sensitive information such as user authentication, account information, or credit card information.

Note that if you are really concerned about your application security, you might consider using config.force_ssl in your config file instead. That will ensure all the data is transferred via HTTPS, and will prevent the user from getting their session hijacked when accessing the site over unsecured HTTP protocol.

Constant Summary

::ActiveSupport::Callbacks - Included

CALLBACK_FILTER_TYPES

Class Method Summary

::ActiveSupport::DescendantsTracker - self

clear, descendants, direct_descendants,
store_inherited

This is the only method that is not thread safe, but is only ever called during the eager loading phase.

::ActiveSupport::Concern - Extended

append_features, class_methods, included

Instance Attribute Summary

::AbstractController::Callbacks - Included

#__callbacks, #__callbacks?

Instance Method Summary

::AbstractController::Callbacks - Included

#process_action

Override AbstractController::Base#process_action to run the process_action callbacks around the normal behavior.

::ActiveSupport::Callbacks - Included

#run_callbacks

Runs the callbacks for the given event.

Instance Method Details

#force_ssl_redirect(host_or_options = nil)

Redirect the existing request to use the HTTPS protocol.

Parameters

  • host_or_options - Either a host name or any of the URL and redirect options available to the force_ssl method.

[ GitHub ] 

  


# File 'actionpack/lib/action_controller/metal/force_ssl.rb', line 78



def force_ssl_redirect(host_or_options = nil)
  unless request.ssl?
    options = {
      protocol: "https://",
      host: request.host,
      path: request.fullpath,
      status: :moved_permanently
    }

    if host_or_options.is_a?(Hash)
      options.merge!(host_or_options)
    elsif host_or_options
      options[:host] = host_or_options
    end

    secure_url = ActionDispatch::Http::URL.url_for(options.slice(*URL_OPTIONS))
    flash.keep if respond_to?(:flash) && request.respond_to?(:flash)
    redirect_to secure_url, options.slice(*REDIRECT_OPTIONS)
  end
end