• Passenger-supported apps

    Overview Passenger supports Python, Ruby, Node.js, Meteor as well as any application built using this technology. In creating several of the articles in this knowledgebase, we also created a very basic application to guide during writing. These applications are up and running under a sandbox domain and represent just a sliver…

  • Disabling Passenger built-in error handler

    Overview Passenger provides a user-friendly, on-screen error handler to assist debugging a Python/Ruby/Node.js application. During production, however, this may result in unnecessary and possibly dangerous information disclosure. You can turn off Passenger’s built-in logger and use Apache’s generic error handler by adding the following line to your .htaccess file located within the…

  • Restarting Passenger processes

    Overview An application launched by Passenger may be restarted by creating a file in tmp/ (NB: not /tmp) within the application root directory, usually one level down from public/. Create a file under tmp/ named restart.txt to restart the application once. A restart will happen within 2 minutes. To restart an application on…

  • CGI and FastCGI permissions

    Overview All CGI and FastCGI requests operate as the owner of the file and require heightened security to limit malicious behavior. There are a few guidelines that must be adhered to when a CGI or FastCGI script, ending in .cgi, is accessed on your hosting account: File permissions must be 755 (u=rwx,g=rx,o=rx)…

  • File uploads in a Passenger-backed application fail

    Overview A file upload initiated in an application written in Ruby, Node, or Python launched through Passenger will fail to upload. Thus far, the confirmed failure occurs in RefineryCMS with a generic undefined route message following upload. Example conflict in RefineryCMS. Following upload, RefineryCMS reports the route as undefined. Cause It…

  • Forcing HTTP redirect to SSL

    Overview Converting HTTP to HTTPS resources can be accomplished in several ways. It goes without saying that you should setup and test your SSL certificate before performing any of the following methods. Strict Transport Security Modern browsers support a security standard called “HTTP Strict Transport Security“, or HSTS for short….