spree/spree — pull request #2308 by huoxito (2012-12-12 06:07:22+00:00)
Title: Removes SslRequirement in favor of Rails built in force_ssl

I believe we have an issue with the current way Spree deals with SSL and the way Rails > 3.1 does. There's a redirect loop when ``config.force_ssl = true`` is set on the Rails app. It happens most likely because of this filter https://github.com/huoxito/spree/blob/master/core/lib/spree/core/ssl_requirement.rb#L104.

In case the store needs to have SSL enabled all over it and an user access http://store.com/products, for example, Rails redirects to https but then Spree checks if that controller calls ``ssl_required`` and since ``Spree::ProductsController`` doesn't the user is redirected back to http and it goes on and on ..

A work around for this might be adding ``ssl_required`` to the app ``ApplicationController``.

```ruby
class ApplicationController < ActionController::Base
include Spree::Core::ControllerHelpers::Auth # or include Spree::Core::ControllerHelpers for Spree 1.2
ssl_required
end
```

This pull request tries to make it easier to enable SSL all over the app and to avoid surprises when the Rails config force_ssl is used. What do you think?

Also I wonder what's the main reason for Spree not default to force SSL in every request rather than only care about it on checkout, order/show and admin routes. Or maybe why Spree cares at all about forcing SSL. I imagine forcing SSL inside Spree might be safer for inexperienced users but I'm pretty sure inexperienced users will have trouble anyway, as I did, either trying to setup on production servers or having unpleasant surprises with http request inside a https. Maybe Spree would do better just by strongly encouraging users to use force_ssl on its README and guides rather then providing configs to enable it or not which Rails itself already does.