From 280b95e3fd018038dc2cadb2084a2d7a328dda28 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sat, 22 Apr 2017 18:23:50 +0200 Subject: [PATCH] Enforcing HTTPS for authentication matters --- config/environments/development.rb | 4 ++++ config/environments/production.rb | 2 ++ 2 files changed, 6 insertions(+) diff --git a/config/environments/development.rb b/config/environments/development.rb index 764e618..4153699 100644 --- a/config/environments/development.rb +++ b/config/environments/development.rb @@ -75,4 +75,8 @@ Rails.application.configure do } # config.file_watcher = ActiveSupport::EventedFileUpdateChecker + + # Any action dealing with authentication should redirect to HTTPS + config.to_prepare { Devise::SessionsController.force_ssl(port: 3001) } + end diff --git a/config/environments/production.rb b/config/environments/production.rb index 69624d8..b81a232 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -106,4 +106,6 @@ Rails.application.configure do small: '160x120', } + # Any action dealing with authentication should redirect to HTTPS + config.to_prepare { Devise::SessionsController.force_ssl } end