c42/survey-web — pull request #22 by timothyandrew (2013-05-17 12:40:19+00:00)
Title: HTTPS Support

Two approaches.

Redirect all HTTP requests to HTTPS
--------------------

- Use `config.force_ssl = true`
- Mobile needs to update its server URL to a HTTPS URL.
- This can be done using an update
- Mobiles without the updated URL will fail all API calls (no data loss - "Please check your internet connection and try again"). This is because Titanium doesn't follow the redirect to HTTPS.
- Its unreasonable to expect all mobiles to have the latest update, so this approach is not going to work.

No HTTPS unless https:// is Explicitly Mentioned
-------------------------

- Use this setting in `production.rb`

```ruby
config.middleware.insert_before ActionDispatch::Static, Rack::SSL, :exclude => proc { |env| env['HTTPS'] != 'on' }
```
- Requests with `http://` will stay on `http://`. Requests with `https://` will use SSL.
- Existing mobiles will work okay even with the old URL. Their requests will *not* use SSL until they get the update.
- However on web, going to `http://thesurveys.org/` and logging in will ***not*** work (the OAuth callback uses `https://`)
- We can redirect just the `root_path` (surveys index page) to `https://` regardless of the request.
- This way web users will be forced to use SSL, but mobile users on older builds can continue using HTTP until they upgrade.