CODEWITHSUNDEEP
ruby-on-railsnginxunicorn
n8gard
n8gard

Reputation: 1970

Why is SSL redirect not working with force_ssl and Nginx?

I have a Rails 3.2.13 app that I am trying to configure SSL for with Nginx and Unicorn. I want to be able to tell some controllers and some controller actions to 'force_ssl' and to properly redirect. I have been able to get this working so that I can manually hit the app with 'https://foo.com' and things work. When I put 'force_ssl' into a controller action, let's say users#index:

class UsersController < ApplicationController
  force_ssl

  def index
    # do some stuff
  end

end

I would expect that if I navigate to 'http://foo.com/users' that it would redirect to 'https://foo.com/users'. It does not.

Instead, it redirects to: 'https://unicorn_foo/users'. What am I missing?

nginx.conf:

upstream unicorn_foo {
  server unix:/tmp/unicorn.foo.sock fail_timeout=0;
}

server {
    listen 80 default;
    server_name foo.com;
    root /home/webuser/apps/foo/current/public;

    location ^~ /assets/ {
        gzip_static on;
        expires max;
        add_header Cache-Control public;
    }

    try_files $uri/index.html $uri @unicorn_foo;

    location @unicorn_foo {
        proxy_set_header X-Forwarded-Proto http;
        proxy_pass http://unicorn_foo;
    }
    error_page 500 502 503 504 /500.html;
    client_max_body_size 5G;
    keepalive_timeout 10;
    send_timeout 240;
    sendfile_max_chunk 5m;
}

server {
    listen 443;
    server_name foo.com;
    root /home/webuser/apps/foo/current/public;

    location ^~ /assets/ {
        gzip_static on;
        expires max;
        add_header Cache-Control public;
    }

    try_files $uri/index.html $uri @unicorn_foo;

    location @unicorn_foo {
        proxy_set_header  X-Real-IP       $remote_addr;
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header  X-Forwarded-Proto https;
        proxy_set_header  Host $http_host;
        proxy_redirect    off;
        proxy_pass http://unicorn_foo;
    }
    error_page 500 502 503 504 /500.html;
    client_max_body_size 5G;
    keepalive_timeout 10;

    ssl on;
    ssl_certificate         /etc/nginx/ssl/server.crt;
    ssl_certificate_key     /etc/nginx/ssl/server.key;
    ssl_protocols           SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers             ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;
    ssl_session_cache       shared:SSL:10m;

    send_timeout 240;
    sendfile_max_chunk 5m;
}

Upvotes: 3

Views: 2781

Answers (1)

whoisjake
whoisjake

Reputation: 622

First guess... the port 80 server block does not pass the host through, maybe that's it?

proxy_set_header  Host $http_host;

The SSL block does, but if you start at the non-SSL side and Rails picks it up, it might not have the full header there?

Upvotes: 4

Related Questions