title: Rails Devise SSL Session Mix Up on Production
body: <p>I've deployed my app on to a Ubuntu VPS using Capistrano, nginx/
  Passenger and a wildcard SSL certificate.</p>
  
  <p>The app works fine on development and my staging environment on
  Heroku.</p>
  
  <p>However, there are two problems on production when users sign into the
  site using a secure page.</p>
  
  <ol>
  <li><p>On latest Chrome and Firefox the browsers start to enforce HTTPS
  requests on every single request every time. Regardless if the user is
  signed in or not. Even if I disable SSL on nginx the browser still attempts HTTPS and complains it cannot connect. The main page serves some insecure dynamic embedded
  items and uses an insecure CDN so I would like to serve that page as non-
  SSL. Whenever I tried to redirect a page to non-SSL either through
  nginx rewrite or a before filter in Rails it will cause an infinite
  redirect loop.</p></li>
  <li><p>Safari does not have the first problem as above it respects both
  HTTPS and HTTP requests. However, when the user has logged in and
  browses to a non-SSL page they are signed out or lose the session
  instantly.</p></li>
  </ol>
  
  <p>Has anyone encountered such a problem before or have an idea on how I could diagnose/fix the problem?</p>
  
  <p>Thanks </p>