From fe94d84e817f1d397393fceab3c4321ce8315da1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javi=20Mart=C3=ADn?= Date: Sat, 15 Jul 2023 14:54:10 +0200 Subject: [PATCH] Use 308 as SSL default redirect status This way user agents will know that the redirection from HTTP to HTTPS is permanent and not temporary, which is the case if we activate the `force_ssl` option (which we do by default). --- config/initializers/new_framework_defaults_6_1.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/new_framework_defaults_6_1.rb b/config/initializers/new_framework_defaults_6_1.rb index cbbd28b3e..2eadefb64 100644 --- a/config/initializers/new_framework_defaults_6_1.rb +++ b/config/initializers/new_framework_defaults_6_1.rb @@ -37,7 +37,7 @@ ActiveSupport.utc_to_local_returns_utc_offset_times = true # Change the default HTTP status code to `308` when redirecting non-GET/HEAD # requests to HTTPS in `ActionDispatch::SSL` middleware. -# Rails.application.config.action_dispatch.ssl_default_redirect_status = 308 +Rails.application.config.action_dispatch.ssl_default_redirect_status = 308 # Use new connection handling API. For most applications this won't have any # effect. For applications using multiple databases, this new API provides