:strict option + AJAX requests

[tobmatth]

:strict option + AJAX requests

[rymai]

Hi,

So, for instance, if I'll add a rule to :only array that matches my ajax request url, it will work if current page is served via https and will fail via http.

Let's take a concrete example:

config.middleware.use Rack::SslEnforcer, :only => ['/ajax']

You say that GET https://yourdomain.com/ajax would succeed and GET http://yourdomain.com/ajax would fail, is that correct? If yes, I don't understand why, it should just redirect the second GET to HTTPS, no?

Regarding your proposal for a :skip option, could you give concrete examples because I have big trouble understanding the use cases for which it could be useful!

Thanks!

[blelump]

Let's take a concrete example:

config.middleware.use Rack::SslEnforcer, :only => ['/ajax']

You say that GET https://yourdomain.com/ajax would succeed and GET http://yourdomain.com/ajax would fail, >is that correct? If yes, I don't understand why, it should just redirect the second GET to HTTPS, no?

Yep, it will redirect, but since it's ajax req, it violates the same origin policy, as suggested here: #31 (comment) . A real example might be useful: assume that you have a button called "feedback" sticked to the right border of browser. When an user clicks on such button, new dialog will appear. Besides that, content of that dialog loaded dynamically (response of previously called feedback request). Now, if you want to send a feedback from within login page (https) and your config looks like :only => ['/login'], :strict => true, it will fail because of redirection (same origin policy violation).
So my idea was to add additional :skip option, where I could provide a list of regexp's to match. If any matches, then such url is not even considered within SSL enforcer lib. It is just skipped, so if current context is https, it calls ajax req as https and same for http. I know a workaround might be to disable :strict => true, but then I even do not need SSL Enforcer since it can be done with an additional filter within base controller. What do you think about it? Is it slightly more clear now?

[rymai]

Thanks for the clarification.

Imagine you POST your feedback on /feedback, can't you just use the following configuration:

config.middleware.use Rack::SslEnforcer, :only => ['/login', '/feedback'], :strict => true

so there won't be a redirect when you POST your feedback in AJAX?

[blelump]

That would work, but what with http? Assume that I log in sucessfully and then got redirected to dashboard panel which is served via http. Now, I want to send a feedback, but request will redirect to https and again same policy violation. Feedback button is accessible on every page.

[mixellent]

+1 (@blelump)

[rymai]

Hi guys,

There's actually already a solution for that: the :ignore option. Also, you can take a look at #39 for additional info.

@blelump do you confirm it solves your use case?

[tobmatth]

I'm closing here. Feel free to reopen...