diff --git a/config/environments/production.rb b/config/environments/production.rb index 339955a..d72a38a 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -24,11 +24,11 @@ Rails.application.configure do # Store uploaded files on the local file system (see config/storage.yml for options). config.active_storage.service = :local - # Assume all access to the app is happening through a SSL-terminating reverse proxy. + # Assume all access to the app is happening through a SSL-terminating reverse proxy. config.assume_ssl = true # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies. - config.force_ssl = true + config.force_ssl = ENV.fetch("RAILS_FORCE_SSL", "false") == "true" # Skip http-to-https redirect for the default health check endpoint. # config.ssl_options = { redirect: { exclude: ->(request) { request.path == "/up" } } } @@ -94,6 +94,9 @@ Rails.application.configure do # Only use :id for inspections in production. config.active_record.attributes_for_inspect = [ :id ] + config.action_controller.default_url_options = { host: "fabsparestore.com", protocol: "https" } + + # Enable DNS rebinding protection and other `Host` header attacks. # config.hosts = [ # "example.com", # Allow requests from example.com