mardi 2 juin 2015

Is it necessary to force_ssl? Or should the SSL terminate at the load balancer?

On AWS OpsWorks. I'm using an ELB, which has my CA's SSL certificate.

The first point of access is always the load balancer (ELB). The ELB directs traffic to the instances. The instances each have a copy of the Rails app, Unicorn, etc.

One thing to note. The instances behind the ELB cannot be accessed directly.

At this point, do I need to force_ssl in Rails? I hear it's common enough to terminate SSL at the border (ELB).

As far as I've read, force_ssl gives the following:

  1. force_ssl automatically redirects traffic from http to https.
  2. Flagging cookies as secure and some added protection (i.e. against MITM attacks).

http://ift.tt/1FsU3Oi only indicates http to https redirection.

What does force_ssl do in Rails? second answer suggests that force_ssl does more than redirection.

Without force_ssl, I can manage redirects by writing Nginx definitions.

I feel like forcing SSL via Rails seems obsolete, since the SSL negotiation is already happening in the ELB. Is it still necessary to force_ssl? Are there any added benefits?




Aucun commentaire:

Enregistrer un commentaire