Odd redirection in Ruby on Rails

Question

I am getting odd redirection in general. It works in development but not production. Here are the responses for an update. The same things happens on a create.

DEVELOPMENT

Redirected to http://localhost:3000/trackers
Completed 302 Found in 43ms (ActiveRecord: 18.7ms)
Started GET "/trackers" for 127.0.0.1 at 2014-01-06 06:41:02 -0600

PRODUCTION

Redirected to http://example.com/trackers
Completed 302 Found in 218ms (ActiveRecord: 63.9ms)
Started GET "/" for [IP} at 2014-01-05 20:15:33 +0000

routes.rb (pertinant)

              trackers GET    /trackers(.:format)                       trackers#index
                       POST   /trackers(.:format)                       trackers#create
           new_tracker GET    /trackers/new(.:format)                   trackers#new
          edit_tracker GET    /trackers/:id/edit(.:format)              trackers#edit
               tracker GET    /trackers/:id(.:format)                   trackers#show
                       PUT    /trackers/:id(.:format)                   trackers#update
                       DELETE /trackers/:id(.:format)                  trackers#destroy

Here is my tracker controller

class TrackersController < ApplicationController
 before_filter :authenticate_user!
load_and_authorize_resource

def create
  @tracker = params[:tracker]
  @user = current_user
  if @user.trackers.create(@tracker)
   redirect_to trackers_path, :notice => "New Tracker Created!"
  else
   redirect_to trackers_path, :notice => "Tracker Could not be created."
  end
end

def update
  @tracker = Tracker.find(params[:id])
  if @tracker.update_attributes(params[:tracker])
   redirect_to trackers_path, :notice => "Tracker Updated!"
  else
   redirect_to trackers_path(params[:id]), :notice => "Unable to Update Tracker"
  end
end

end

NGINX

upstream unicorn{
server unix:/tmp/unicorn.legalleads.sock fail_timeout=0;}


server {
listen      80;
server_name example.com;
return 301 https://$host;}


server {

listen 443 default;
server_name example.com;
root /home/a/apps/legalleads/public;
try_files $uri/index.html $uri @unicorn;

ssl on;
ssl_certificate /etc/nginx/ssl/com.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;


location ^~ /assets/ {
  gzip_static on;
  expires max;
  add_header Cache-Control public;
}

location @unicorn {
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header Host $http_host;
 proxy_redirect off;
 proxy_pass http://unicorn;
}

error_page 500 502 503 504 /500.html;
client_max_body_size 4G;
keepalive_timeout 10;
}

Answer 1

Faraz, thank you so much for the hint on this. Here is the solution and the blog that helped me find the answer

http://blog.seancarpenter.net/2013/09/02/rails-ssl-route-generation-with-nginx-and-unicorn/

I had to tell nginx to keep the https. This is why some of the time it would work and sometimes it would not.

location @unicorn {
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header Host $http_host;
  proxy_redirect off;
  proxy_pass http://unicorn;
}

Had to be changed to

location @unicorn {
  proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header    X-Forwarded-Proto https; # New header for SSL
  proxy_set_header    Host $http_host;
  proxy_redirect      off;
  proxy_pass          http://unicorn_something_server;
}

Answer 2

You're chaining together renders and redirects in a way thats incompatible with the HTTP spec. From the limited part of your controllers that you've presented, I assume a POST request is being made on sign in, that feeds into a redirect, which then feeds into yet another redirect or render. That final redirect/render call is the culprit.

If the 302 status code is received in response to a request other than GET or HEAD, the user agent MUST NOT automatically redirect the request unless it can be confirmed by the user, since this might change the conditions under which the request was issued.

From HTTP/1.1 Status Code Definitions.

You should trace the logic in all of your callbacks to ensure that you call render/redirect only once at the end of a POST request.