fastly/fastly-rails — pull request #34 by jjulian (2014-12-22 19:00:33+00:00)
Title: Properly tell Rails that a request is (or is not) SSL

When hosting on Heroku, the Heroku router sets `X-Forwarded-Proto` to the protocol used by the immediate connection (from Fastly). If it's https, then Rails will never know if a browser connects insecurely. If it's http, then Rails will think every connection is insecure, even when the browser connection to fastly is over https.

This Rack middleware fixes that by setting the proper headers based on the `Fastly-SSL` header. The fixes are only applied if the connection appears to be from Fastly.

* set HTTPS=on
* set X-Forwarded-Proto=https
* remove other ambiguous headers