Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Related: Add www to non-www address with ssl

I'm working with a Rails app and having a ton of issues getting SSL for certain routes to work. I thought I'd instead just do a brute force approach and solve this in nginx config... fewer moving parts involved, more certain to work is my thinking.

For example, let's say I have a path that looks like 'http://mysite.com/users/sign_in'. Would I force that path to use SSL like so?

location / {
      rewrite  ^http://(.*)(/users/sign_in/)(.*)$  https://$1$2$3 permanent;
    }

Can anyone recommend a good resource for doing this sort of https/http redirection in nginx?

share|improve this question
2  
For the record http->https redirection isn't really a great idea. If you have a invalid URL in some form pointing to http, clients may transmit important data to the HTTP web site, and not realize it, because of the auto-redirect. –  Zoredache Mar 2 '12 at 20:38

1 Answer 1

Not an answer to your question, but an answer to your problem: Only encrypting the login page is almost as dangerous as not encrypting anything. If security is important, encrypt everything -- http://codebutler.com/firesheep

share|improve this answer
    
So I think what your saying is: as soon as the user logs in via https, all remaining traffic should be via https until the user logs out, and then the site should return to http. Can you point me to a reference for this? I've read the firesheep article but I'm hoping to see something more... authoritative? –  jcollum Mar 3 '12 at 0:26
    
Actually I would (and do) do it an even simpler way -- for any site where security matters, use HTTPS everywhere, all the time. Not sure what you mean by authoritive -- you've seen a tool which automatically breaks into non-https-everywhere sites, but you want a newspaper to back it up? :S –  Shish Mar 8 '12 at 17:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.