I added SSL to a previously static and non-SSL website because some new features will require it. I'm using rails 4.0.5, ruby 1.9.3, and the site is deployed on heroku (it's at www dot palleylaw com).
The newly SSL site included content from my non-SSL blog (it's at www spblog dot herokuapp com). I had been grabbing the content via Feedburner, right to the view. But Feedburner is http only, so was no longer an option. I don't want to add SSL to the blog site and I want the two sites to remain separate.
- I used Nokogiri to grab the index.xml in a controller and then display the content that I want in the view. The code below that does this "works" in that I don't get errors in my error console and the lock icon now shows up when you browse to the SSL site. (I think I understand why, that because it's provided through a controller I'm getting the feed server side, not client side through an external feed).
That said, I'm not a security expert or professional programmer, and am teaching myself all of this stuff as I go. This is my first foray into SSL (and Nokogiri for that matter) and am learning Ruby (you will see I am not entirely clear on the difference between to_s and to_string, just that the difference matters here and allows the code to work). So there are a ton of moving parts and I had to learn more than a few new things to do this.
Are there any glaring holes in the code or approach? Is there a better way to do this (or a resource that I should consider using instead)?
# force access to the app over https config.force_ssl = true
def home # save the blog content to the local variable 'feed'' feed = Nokogiri::XML(open('http://blog.site.com/index.xml')) # grab the content we want and save in instance variables that can be used in the view @title =feed.css("title") @summary =feed.css("summary") @date =feed.css("published") # define counter for number of post items we want to display in the view @counter = [1,2,3,4] end
# some basic markup for the div containing the feed partial <h2>Blog</h2> <small>full posts @ blog.site.com</p></small> <hr> # using the instance variable that we set in the controller, loop through the elements 4 # times, displaying with html format # need to understand difference between to_str and to _s, as well as html_safe — is it necessary? @summary throws no method error with to_s but works with to_string — why? <% @counter.each do |i| %> # Loop through selected elements in each post <p><%= @title[i].text.to_s.html_safe %> | <%= @date[i].to_s.html_safe %><br> <hr> <p><%= @summary[i].to_str.html_safe%></p> <p><a href="http://blog.site.com" target="_blank">More . . .</a>/<p> <hr> <p></p> <% end %>