在Rails中使用SSL

   当RAILS中需要指定一些方法必须在ssl在访问的时候，就会用的这样的插件
github官网
当前版
简单版

  class ApplicationController < ActiveRecord::Base
    include SslRequirement
  end

  class AccountController < ApplicationController
    ssl_required :signup, :payment
    ssl_allowed :index
    
    def signup
      # Non-SSL access will be redirected to SSL
    end
    
    def payment
      # Non-SSL access will be redirected to SSL
    end

    def index
      # This action will work either with or without SSL
    end

    def other
      # SSL access will be redirected to non-SSL
    end
  end

   然而，在使用的时候，遇到了问题。mod_rewrite没有设置HTTP_X_FORWARDED_PROTO头，所以，从mongrel来的请求不能确认是https的，所以就需要下面的修改

def ensure_proper_protocol
  #ssl_requirement.rb, line 49
  return true if ssl_allowed?
  if ssl_required? && !(request.ssl? || request.port == 443)
    redirect_to "https://" + request.host + request.request_uri
    return false
  elsif (request.ssl? || request.port == 443) && !ssl_required?
    redirect_to "http://" + request.host + request.request_uri
    return false
    end
end

引用

You can overwrite the protected method ssl_required? to rely on other things
than just the declarative specification. Say, only premium accounts get SSL.

P.S.: Beware when you include the SslRequirement module. At the time of
inclusion, it'll add the before_filter that validates the declarations. Some
times you'll want to run other before_filters before that. They should then be
declared ahead of including this module.