diff --git a/app/views/layouts/tutorial/ssl_tls/_ssl_tls_first.html.erb b/app/views/layouts/tutorial/ssl_tls/_ssl_tls_first.html.erb index 5acc83b..3bf824d 100755 --- a/app/views/layouts/tutorial/ssl_tls/_ssl_tls_first.html.erb +++ b/app/views/layouts/tutorial/ssl_tls/_ssl_tls_first.html.erb @@ -16,7 +16,9 @@
+ Applications frequently fail to authenticate, encrypt, and protect the confidentiality and integrity of sensitive network traffic. When they do, they sometimes support weak algorithms, use expired or invalid certificates, or do not use them correctly. +
+ The application currently does not use SSL (this is not the bug). Once it does, we will show the bug. For now, check out the solution section. +
+ In order to enforce transport layer security and ensure all requests are made over SSL, navigate to the environment file that matches the environment you would like to apply this to and add: +
++ config.force_ssl = true ++
+ To protect sessions from being sent over non-encrypted channels, mark your cookies with the secure flag. Under config/initializers/session_store.rb added the following option (highlighted): +
+
+ Railsgoat::Application.config.session_store :cookie_store, key: '_railsgoat_session', :secure => true
+