rack-ssl-enforcer
rack-ssl-enforcer copied to clipboard
Forcing HTTPS only on certain paths or methods might be a security problem
Hello.
The topic shall be self-explanatory, but I could gladly comment on it more.
The API allows (and maybe even encourages) users to exclude certain paths and HTTP methods from using/enforcing ssl.
This might lead to security problems and shall be highly recommended against.
There is however no mention of it in documentation and the methods are welcoming.
I would rename the methods to contain _insecure or _dangerous, and mention in the docu that their usage is a bad idea.