Force SSL for Heroku apps running in EU region

问题:

I'm struggling to enforce an SSL connection for a rails app running on Heroku (EU region).

I've added the cert (inc Heroku SSL add-on) to a custom domain successfully (if I explicitly state https://..com it works perfectly)

But I want to redirect all http requests to a https connection.

For apps in the US regions this require pointing custom domain DNS records to .herokussl.com NOT .herokuapp.com. Docs: https://devcenter.heroku.com/articles/ssl-endpoint#dns-and-domain-configuration

For apps in EU regions, custom DNS records should still point to .herokuapp.com which does not appear to enforce a SSL connection by default.

Therefore, my question is: how can I make all connections to my Heroku app running in Europe be forced to run through SSL?

回答1:

production.rb

Rails.application.configure do
    config.force_ssl = true
end

This will redirect all http traffic to https

Edit: Its worth noting that this is a Rails thing rather than a heroku one.

Revision:

As this answer/question regularly gets seen and upvoted, it's also possible within a controller on a per request basis:

class AccountsController < ApplicationController
  force_ssl if: :ssl_configured?

  def ssl_configured?
    !Rails.env.development?
  end
end

回答2:

FYI your question mentions herokussl.com which is part of the deprecated Heroku SSL Endpoint service. Heroku now recommends using the Heroku SSL service:

The SSL Endpoint add-on is only recommended if you need to support legacy browser clients which do not support SNI. Our default recommendation is to use the Heroku SSL described in this document.

Also note that appname.herokuapp.com domains are already SSL-enabled and can be accessed by using https, for example, https://appname.herokuapp.com.