How to use a Rails App with HTTPS

Summary

We need to provide HTTPS support to test your rails application on your local server. Sensitive data such as passwords are submitted during login and register stages and we want to encrypt the transmission of this data between the client browser and the server. The HTTPS protocol proves this security.

For developing we currently run the Mongrel server. To achieve HTTPS we need to put an Apache server in front of this Mongrel server. The Apache handles the SSL encryption, certificates etc and acts as a type of proxy to the Mongrel rails server.

The end result of the following steps is a Rails app that works with HTTPS.

Install SSL enabled Apache

Install an SSL enabled Apache. The fastest and most convenient method I’ve found is the XAMPP installer.

It’s a one click installer. Download and run. SSL enabled Apache is one of the programs installed that’s what we’re interested in. Ignore the rest (PHP etc).

WINXP

http://www.apachefriends.org/en/xampp-windows.html

MAC OSX

http://www.apachefriends.org/en/xampp-macosx.html

Or if you’re feeling brave install and configure an SSL enabled Apache yourself.

NOTE: mySQL is also installed with XAMPP. However if it causes confilict with your exisintg mySQL you can turn it off via the provided admin panel/command line and use your existing mySQL.

Configure Apache to work Mongrel

Having insalled the XAMPP you will have an Apache directory conf that contains the Apache configuration files.

Edit the Apache file conf/httpd.conf.

Uncomment the following lines:

LoadModule proxy_module modules/mod_proxy.so

and other proxy modules mentioned.

Also uncomment

LoadModule headers_module modules/mod_headers.so

In the Apache file conf/extra/httpd-vhosts.conf edit the following:

Make sure this line exists

NameVirtualHost *:80

Add the following vhost

<VirtualHost *:80>

ServerName Mydomain

ProxyPass / http://localhost:3002/

ProxyPassReverse / http://localhost:3002

</VirtualHost>

To make the above vhost work for us we also need to edit the hosts file in WinXP. Mydomain

WinXP

C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 Mydomain

And on the MacOSX, add the same to the /etc/hosts

Start the Apache server

At this point you will have Apache server set up. Start the Apache server.

Test your Apache is running, browse to http://localhost, you’ll get the Apache XAMPP page with some useful tools.

Start the mongrel server

At this point you will have Apache running so start Mongrel

ruby script/server -p 3002

Now browse to http://Mydomain

Browsing to the URL http://Mydomain takes you to localhost (127.0.0.1) via hosts file you edited and there an Apache vhost checks the URL, and sees that it is Mydomain then passes it onto the Mongrel server running http://localhost:3002

Enable HTTPS

Configure Apache to use SSL and configure Mongrel to know about it

Edit the Apache file conf/extra/httpd-ssl.conf

Inside the vhost <VirtualHost _default_:443>

Comment out

DocumentRoot “C:/xampp/htdocs”

Put in the following

ServerName Mydomain:443

ProxyPass / http://localhost:3002/

ProxyPassReverse / http://localhost:3002

RequestHeader set X_FORWARDED_PROTO “https”

At this stage start your development environment is set up. Just start Apache, and Mysql then run your rails app and browse to http://Mydomain to view it.

Now requests to https:// urls in Rails app should work.

Set up Rails to work with SSL protocol

The following steps were required to set up the rails app to work with the SSL protocol.

Make sure that the SSL plug-in for Rails is installed.

ruby script/plugin install ssl_requirement

Next edit the ApplicationController, add the line ‘include SslRequirement ‘

class ApplicationController < ActionController::Base

include SslRequirement

Now you can set policies for individual actions in each of the controllers.

EG

In the AuthController we want the login and the authenticate action accessible via SSL only.

class AuthController < ApplicationController

ssl_required :login, :authenticate

Now requests to http://Mydomain/login will redirect to https:// Mydomain/login

The End.

References

Mongrel and Rails behind Apache 2.2 and SSL

http://blog.innerewut.de/2006/06/21/mongrel-and-rails-behind-apache-2-2-and-ssl#comment-form

“Agile Web development with Rails”, Page 612

This entry was posted on Wednesday, October 31st, 2007 at 2:08 pm and is filed under Rails, Web Development. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.