How do you handle SSL in development?

Question

I have an application that uses HTTPS for some of its routes in conjunction with the ssl_requirement plugin. It's deployed and is working fine in production.

The question is how best to handle this in development, because at the moment I'm simply hacking my routes.rb to remove the :requirements key and obviously that's not very convenient or elegant:

map.resource :session, :controller => 'session',
                       :only => [:new, :create, :destroy],
                       :requirements => { :protocol => 'https' }

Ideally I'd like to be able to run the secure parts of my application in development on Mongrel without any changes. How can I achieve this? I'm using Mac OS X.

Answer 1

As your rails apps get more complicated and you want to use advanced features like SSL your best bet is to switch to a development environment which more closely matches your production environment. This will allow you to create your own SSL certs and test in a way which will mirror the way your users will use your application.

I suggest moving to the same webserver as you use in production, which you've mentioned is apache/passenger.

In a related question... how do you manage your test environment with ssl? For this I'm currently hacking up my routes as you're doing. Is there a better way?

Answer 2

Don't worry about SSL in development

For a development environment, IMO, you don't need to run SSL. It's not worth the time or hassle, especially as more people join the team. With regards to your routes, I would simply keep the protocol as http in the development environment:

protocol = Rails.env.development? ? "http" : "https"

map.resource :session, :controller => 'session',
                       :only => [:new, :create, :destroy],
                       :requirements => { :protocol => protocol }

Now, where you do need to test your SSL integration is on your staging environment -- the place where you deploy to just prior to deploying to production. This is where you want to accurately replicate your production environment. Your development environment does not need to match your production environment in this same way.