Properly tell Rails that a request is (or is not) SSL

[jjulian]

When hosting on Heroku, the Heroku router sets X-Forwarded-Proto to the protocol used by the immediate connection (from Fastly). If it's https, then Rails will never know if a browser connects insecurely. If it's http, then Rails will think every connection is insecure, even when the browser connection to fastly is over https.

This Rack middleware fixes that by setting the proper headers based on the Fastly-SSL header. The fixes are only applied if the connection appears to be from Fastly.

• set HTTPS=on
• set X-Forwarded-Proto=https
• remove other ambiguous headers

[jjulian]

Note that this is totally optional behavior, only used if the user inserts the middleware into their Rails stack.