DON’T CACHE AUTHENTICATED PAGES 611

class AccountController < ApplicationController ssl_required :signup, :payment

ssl_allowed :index

def signup

# Non-SSL access will be redirected to SSL end

def payment

# Non-SSL access will be redirected to SSL end

def index

# This action will work either with or without SSL end

def other

# SSL access will be redirected to non-SSL end

end

The ssl_required declaration lists the actions that can be invoked only by HTTPS requests. The ssl_allowed declaration lists actions that can be called with either HTTP or HTTPS.

The trick with the ssl_requirement plugin is the way it handles requests that don’t meet the stated requirements. If a regular HTTP request comes along for a method that has been declared to require SSL, the plugin will intercept it and immediately issue a redirect back to the same URL, but with a protocol of HTTPS. That way the user will automatically be switched to a secure connection without the need to perform any explicit protocol setting in your application’s views.6 Similarly, if an HTTPS request comes in for an action that shouldn’t use SSL, the plugin will automatically redirect back to the same URL, but with a protocol of HTTP.

26.10Don’t Cache Authenticated Pages

Remember that page caching bypasses any security filters in your application. Use action or fragment caching if you need to control access based on session information. See Section 21.5, Caching, Part One, on page 455 and Section 22.10, Caching, Part Two, on page 513 for more information.

26.11Knowing That It Works

When we want to make sure the code we write does what we want, we write tests. We should do the same when we want to ensure that our code is secure.

6. But, of course, that ease of use comes at the expense of having an initial redirect to get you from the HTTP to the HTTPS world. Note that this redirect happens just once: once you’re talking HTTPS, the regular link_to helpers will automatically keep generating HTTPS protocol requests.

Report erratum

KNOWING THAT IT WORKS 612

Don’t hesitate to do the same when you’re validating the security of your new application. Use Rails functional tests to simulate potential user attacks. And should you ever find a security hole in your code, write a test to ensure that once fixed, it won’t somehow reopen in the future.

At the same time, realize that testing can check only the issues you’ve thought of. It’s the things that the other guy thinks of that’ll bite you.

Report erratum