From 6e454456bea41fd985d308687b5f42ece2d6b52a Mon Sep 17 00:00:00 2001
From: Yamagishi Kazutoshi <ykzts@desire.sh>
Date: Sat, 7 Sep 2019 00:33:26 +0900
Subject: [PATCH] Remove deprecated force_ssl
---
app/controllers/application_controller.rb | 6 ------
config/environments/production.rb | 8 ++++++++
spec/controllers/application_controller_spec.rb | 14 --------------
3 files changed, 8 insertions(+), 20 deletions(-)
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index bd3d13774..95b6eff15 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -5,8 +5,6 @@ class ApplicationController < ActionController::Base
# For APIs, you may want to use :null_session instead.
protect_from_forgery with: :exception
- force_ssl if: :https_enabled?
-
include Localized
include UserTrackingConcern
include SessionTrackingConcern
@@ -40,10 +38,6 @@ class ApplicationController < ActionController::Base
private
- def https_enabled?
- Rails.env.production? && !request.path.start_with?('/health')
- end
-
def authorized_fetch_mode?
ENV['AUTHORIZED_FETCH'] == 'true' || Rails.configuration.x.whitelist_mode
end
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 29d6194dd..843370646 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -44,6 +44,14 @@ Rails.application.configure do
# Allow to specify public IP of reverse proxy if it's needed
config.action_dispatch.trusted_proxies = ENV['TRUSTED_PROXY_IP'].split.map { |item| IPAddr.new(item) } if ENV['TRUSTED_PROXY_IP'].present?
+ # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
+ config.force_ssl = true
+ config.ssl_options = {
+ redirect: {
+ exclude: -> request { request.path.start_with?('/health') }
+ }
+ }
+
# Use the lowest log level to ensure availability of diagnostic information
# when problems arise.
config.log_level = ENV.fetch('RAILS_LOG_LEVEL', 'info').to_sym
diff --git a/spec/controllers/application_controller_spec.rb b/spec/controllers/application_controller_spec.rb
index 1811500df..4db4cc7b7 100644
--- a/spec/controllers/application_controller_spec.rb
+++ b/spec/controllers/application_controller_spec.rb
@@ -47,20 +47,6 @@ describe ApplicationController, type: :controller do
include_examples 'respond_with_error', 422
end
- it "does not force ssl if Rails.env.production? is not 'true'" do
- routes.draw { get 'success' => 'anonymous#success' }
- allow(Rails.env).to receive(:production?).and_return(false)
- get 'success'
- expect(response).to have_http_status(200)
- end
-
- it "forces ssl if Rails.env.production? is 'true'" do
- routes.draw { get 'success' => 'anonymous#success' }
- allow(Rails.env).to receive(:production?).and_return(true)
- get 'success'
- expect(response).to redirect_to('https://test.host/success')
- end
-
describe 'helper_method :current_account' do
it 'returns nil if not signed in' do
expect(controller.view_context.current_account).to be_nil
--
GitLab