rack-ssl-enforcer icon indicating copy to clipboard operation
rack-ssl-enforcer copied to clipboard

Forcing HTTPS only on certain paths or methods might be a security problem

Open qutorial opened this issue 7 years ago • 0 comments

Hello.

The topic shall be self-explanatory, but I could gladly comment on it more.

The API allows (and maybe even encourages) users to exclude certain paths and HTTP methods from using/enforcing ssl.

This might lead to security problems and shall be highly recommended against.

There is however no mention of it in documentation and the methods are welcoming.

I would rename the methods to contain _insecure or _dangerous, and mention in the docu that their usage is a bad idea.

qutorial avatar Jan 03 '18 12:01 qutorial