Rails SSL issue: (https://example.com) didn't match request.base_url (http://example.com)

Question

I just installed an SSL certificate on my site. Unfortunately it has broken the login functionality. After submitting the login form on the site it just redirects to the home pa

Answer 1

I had a similar issue while using Cloudflare's Flexible SSL. I changed it to Full, and activated SSL on my Heroku server.

Found the solution here: http://til.obiefernandez.com/posts/875a2a69af-cloudflare-flexible-ssl-mode-breaks-rails-5-csrf

Answer 2

As rails application server is running behind webserver which is SSL enabled. But the application server is not aware of it and continue with HTTP protocol. Due to which request.base_url gives HTTP URL.

To let the application server know that SSL is enabled and used the https protocol, you need explicitly tell application server.

In the Nginx web server, I have used,

proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Ssl on;

For Apache web server, need to find similar settings.

I think using config.force_ssl = true can solve a problem but not properly since this config, change all HTTP request into HTTPS. Means if someone requests with HTTP it will redirect to HTTPS. config.force_ssl = true will not work in case of API's were you were sending URLs to the client side.

Answer 3

Just run in to the same error. In config/environments/production.rb make sure you have set:

config.force_ssl = true

While not strictly related to this issue, after setting this setting you will need to ensure that your reverse proxy (if you have one) is set up to forward the protocol used to rails by sending the X-Forwarded-Proto header from the proxy to rails. The way this is done depends on which reverse proxy you use (Apache, nginx, etc) and how you have configured it so it's best you look up the specific documentation for the reverse proxy you are using.