0

Related: Add www to non-www address with ssl

I'm working with a Rails app and having a ton of issues getting SSL for certain routes to work. I thought I'd instead just do a brute force approach and solve this in nginx config... fewer moving parts involved, more certain to work is my thinking.

For example, let's say I have a path that looks like 'http://mysite.com/users/sign_in'. Would I force that path to use SSL like so?

location / {
      rewrite  ^http://(.*)(/users/sign_in/)(.*)$  https://$1$2$3 permanent;
    }

Can anyone recommend a good resource for doing this sort of https/http redirection in nginx?

1
  • 2
    For the record http->https redirection isn't really a great idea. If you have a invalid URL in some form pointing to http, clients may transmit important data to the HTTP web site, and not realize it, because of the auto-redirect.
    – Zoredache
    Mar 2, 2012 at 20:38

1 Answer 1

3

Not an answer to your question, but an answer to your problem: Only encrypting the login page is almost as dangerous as not encrypting anything. If security is important, encrypt everything -- http://codebutler.com/firesheep

2
  • So I think what your saying is: as soon as the user logs in via https, all remaining traffic should be via https until the user logs out, and then the site should return to http. Can you point me to a reference for this? I've read the firesheep article but I'm hoping to see something more... authoritative?
    – jcollum
    Mar 3, 2012 at 0:26
  • Actually I would (and do) do it an even simpler way -- for any site where security matters, use HTTPS everywhere, all the time. Not sure what you mean by authoritive -- you've seen a tool which automatically breaks into non-https-everywhere sites, but you want a newspaper to back it up? :S
    – Shish
    Mar 8, 2012 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .