From ee82d8a8761f0bedc97f5e79565b7c5142c1b8bd Mon Sep 17 00:00:00 2001 From: Matt Jankowski Date: Sat, 22 Apr 2017 22:22:22 -0400 Subject: Move force_ssl check to production config (#2165) The force_ssl method from controllers does not add all of the options that the sitewide configuration in a config block does. For example, HSTS enforcement is not added by the controller method, but is added by this style. --- app/controllers/application_controller.rb | 2 -- 1 file changed, 2 deletions(-) (limited to 'app/controllers') diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index a1b9b985c..92755bcd3 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -5,8 +5,6 @@ class ApplicationController < ActionController::Base # For APIs, you may want to use :null_session instead. protect_from_forgery with: :exception - force_ssl if: "Rails.env.production? && ENV['LOCAL_HTTPS'] == 'true'" - include Localized helper_method :current_account -- cgit