7

There is a nice option to config for the Rails app:

config.force_ssl = true

However it seems that just putting that to true doesn't get the HTTPS connections working. Even more - after trying (and failing) to connect to https://localhost:3000 with Chrome, I've set this option to false, and Chrome still tries to open https, even if I write http.

So, couple of questions:

--How to force Chrome not to try https anymore? --What is the proper way of enabling SSL on my Rails app?

Update: The app is run on Heroku, and it seems that https is supported there automagically. Can I test SSL also locally? Like when running rails server?

Alexander Savin
  • 6,202
  • 3
  • 29
  • 41
  • Which webserver do you use>? Rails is middleware! How is that server configured? – Mörre May 04 '12 at 07:55
  • 1
    Did you server set the [Strict Transport Security](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) headers at some point (which Chrome would have remembered)? – Bruno May 04 '12 at 10:39

4 Answers4

5

First, I should say that I haven't tried this, but there are mainly two possibly reasons for Chrome still using HTTPS:

  • Using HTTP Strict Transport Security headers: if the server sets them, the client (supporting HSTS, like Chrome) is meant to stick to HTTPS for all subsequent requests to that host.

  • Permanent redirects. If the initial redirect you got was using "301 Moved Permanently" (and not 302 for example) to make the redirection,(*) the browser is meant to remember it ("The requested resource has been assigned a new permanent URI and any future references to this resource SHOULD use one of the returned URIs").

A likely solution to this would be to clear the cache in your browser.

(*) This question seems to indicate this is the case for Ruby on Rails with this config).

Community
  • 1
  • 1
Bruno
  • 119,590
  • 31
  • 270
  • 376
  • 1
    clearing cache worked for me. I might add that you can go into Inspector(Dev Tools) in Chrome, and in the settings(click gear icon) and check "Disable cache(while DevTools is open)". Then visit site as http://..., then close DevTools, and you should be in business. This avoids having to do a full cache clear(if you don't want to) – Peter P. Feb 05 '14 at 20:10
  • The icons have changed now in chrome, at least in my version for Mac OS. It's still easy, just hit the hamburger in the top right, go history (or command Y for show full history) then hit "clear browsing data" select cache (you can leave your actual browsing history in tact if you like) select "Cookies and other site and plug-in data" and "cached images and files" then you're set. – LpLrich Mar 17 '14 at 13:55
2

I had the same issue. What I did is using an ssl enforcer gem which adds a middleware that handles ssl and redirects. It has a strict option which enforces the configured protocols.

in your Gemfile add:

gem 'rack-ssl-enforcer'

in production.rb add:

config.middleware.use Rack::SslEnforcer, only: %r{your_regex_condition}, strict: true

This will force the requested pages to be secured and the rest to be non secured. It disables the HSTS header which is problematic in chrome (redirect caching issue).

You can also expire the cache for all cleints (if it already exist) to make sure you'll not get infinite redirect:

config.middleware.use Rack::SslEnforcer, only: %r{your_regex_condition}, :hsts => { :expires => 1, :subdomains => false }

also remove the ssl enforcement in production.rb (otherwise it might conflict with this middleware):

config.force_ssl = false
ramigg
  • 1,287
  • 1
  • 15
  • 16
1

Let's see what happened once you updated your config file with:

config.force_ssl = true

This has caused Rack SSL Middleware to be loaded as the first middleware. As you can see in the code, Rack SSL sets an HSTS header by adding this line to the headers :

Strict-Transport-Security

It tells supported browsers such as Chrome to use HTTPS only to access your website.

So once you set back :

config.force_ssl = false

Chrome will still uses HTTPS to access your website and causes an error.

To solve this problem, you need to empty the HSTS cache. You can to that by going to the following url in your chrome browser : chrome://net-internals/#hsts

frenci
  • 21
  • 1
0

Open your Chrome Developer Tools when you're at localhost: Then you can right click the refresh button ↻ and select "Empty cache and hard reload".

This error might also happens to you, if you start your server in the production environment, where HSTS is enabled.

Chrome redirects you to https://localhost:3000/ and says "SSL connection error".

neonmate
  • 509
  • 4
  • 10