HTTP parse error, malformed request - Ruby on Rails

Question

I see the following error in Terminal when attempting to run a Ruby on Rails app.

HTTP parse error, malformed request (): #<Puma::HttpParserError: Invalid HTTP format, parsing fails.>
2017-03-12 13:10:02 -0400: ENV: {"rack.version"=>[1, 3], "rack.errors"=>#<IO:<STDERR>>, "rack.multithread"=>true, "rack.multiprocess"=>false, "rack.run_once"=>false, "SCRIPT_NAME"=>"", "QUERY_STRING"=>"", "SERVER_PROTOCOL"=>"HTTP/1.1", "SERVER_SOFTWARE"=>"puma 3.4.0 Owl Bowl Brawl", "GATEWAY_INTERFACE"=>"CGI/1.2"}

The browser error:

This site can’t provide a secure connection. localhost sent an invalid response. ERR_SSL_PROTOCOL_ERROR*

I have tried the following

Clearing browser cache and restarting
Reverting back to an old commit in GIT that was working at the time
Restarting terminal
Running a different rails app that was functional

First of all, delete all chache of chrome. It works well for me. — sonicmario
– sonicmario, Commented Oct 3, 2018 at 3:37

Toma Nistor · Accepted Answer · 2018-05-09 16:41:52Z

43

Here are some possible solutions.

Make sure you are connecting through http://localhost:3000 and not https://localhost:3000.
If the browser redirects to HTTPS and it's Google Chrome, try this solution that addresses an HSTS problem: https://stackoverflow.com/a/28586593
Make sure you do not have the production environment (if that's what you're serving) forcing HTTPS. If that's the problem, comment this out or change true to false:

config/environments/production.rb
```
# Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
config.force_ssl = true
```

edited May 9, 2018 at 16:41

answered May 10, 2017 at 22:41

Toma Nistor

94312 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Aymen Bou Over a year ago

Thanks for this shout, stupid me was using https instead of http

David Gay Over a year ago

Took me a minute to realize I was accessing https instead of http, thanks to Chrome's stupid protocol hiding.

Mayuresh Srivastava Over a year ago

Make sure you are connecting through localhost:3000 and not localhost:3000, solved it for me.

Pavan Kumar V Over a year ago

@NemyaNation Thanks for your comment I was being stupid as well 😂, used https for localhost 🥲

BenKoshy · Accepted Answer · 2018-09-18 04:31:03Z

For those reading this in the future, consider the following:

Did you change your server in your Gemfile. e.g. from Puma to Thin?
Have you set up an SSL certificate?
Are you starting your webserver with SSL certificate flags?
Is SSL turned on in your development/production environment - and what environment are you invoking?

If you are ok with turning off SSL in your development environment you can do so by going to:

config/environments/development.rb and configuring:

config.force_ssl = false

Here is some code that works for me, using puma, that invokes SSL certification (locally). I have created my certificates and have dumped it in the relevant location:

rails s -b 'ssl://localhost:3000?key=./.ssl/localhost.key&cert=./.ssl/localhost.crt'

When I want to run it in a production environment from my PC I using the following:

rails s -b 'ssl://localhost:3000?key=./.ssl/localhost.key&cert=./.ssl/localhost.crt' -e production

HTH

fedesc · Accepted Answer · 2017-03-12 19:25:07Z

6

seems like you are trying to run HTTPS on your local. You need to have a TLS toolkit (like openSSL) installed on your local. OPENSSL for example.

after you made sure of that, and if still not working, maybe you can find you're answer in the next Github issue. Seems like a bug with Puma gem. GITHUB ISSUE TALK

answered Mar 12, 2017 at 19:25

fedesc

2,6103 gold badges25 silver badges40 bronze badges

Comments

Govind Mantri · Accepted Answer · 2020-11-16 13:37:36Z

3

In my case it was silly mistake I started server on http and my url was pointing to https. I hope it would save someone's time ;)

answered Nov 16, 2020 at 13:37

Govind Mantri

8131 gold badge12 silver badges26 bronze badges

Comments

Kyle-Law · Accepted Answer · 2021-03-11 01:51:51Z

2

Faced this error as well, If the above solutions don't work, do a quick check to see if you have this meta tag in your application.html.erb

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

This will force Google Chrome to redirect localhost to HTTPS

answered Mar 11, 2021 at 1:51

Kyle-Law

2223 silver badges3 bronze badges

Comments

Ricardo Green · Accepted Answer · 2019-12-19 04:04:12Z

1

Access the app using a different browser, or if you are in Chrome access it in Incognito mode. After this the error did not show in any browser again. Remember to remove the config.force_ssl or set it to false in the development.rb file first.

Encountered this today after adding and then removing the config.force_ssl = true config in our Rails 6 app's development.rb file. Tried to access the app in localhost, in a Chrome browser, and the same error showed. Restared rails server several times, to no avail.

The accessing it in different browser, where the force ssl version of the app client was never opened, worked.

answered Dec 19, 2019 at 4:04

Ricardo Green

1,1381 gold badge13 silver badges28 bronze badges

Comments

srussking · Accepted Answer · 2022-10-20 18:42:07Z

If you are setting Content-Security-Policy in your application via action_dispatch.default_headers:

  config.action_dispatch.default_headers = ({
      'Content-Security-Policy' => "default-src 'self' https:;\
        font-src 'self' https: data:;\
        img-src 'self' https: data: blob:;\
        object-src 'self';\
        script-src 'self' https: 'unsafe-inline' 'unsafe-eval';\
        style-src 'self' https: 'unsafe-inline';\
        upgrade-insecure-requests;\
        frame-ancestors *"
    })

Make sure to override that setting in your development environment to add http: options to these. Like so:

  config.action_dispatch.default_headers = ({
    'Content-Security-Policy' => "default-src 'self' http: https:;\
      font-src 'self' http: https: data:;\
      img-src 'self' http: https: data: blob:;\
      object-src 'self';\
      script-src 'self' http: https: 'unsafe-inline' 'unsafe-eval';\
      style-src 'self' http: https: 'unsafe-inline';\
      frame-ancestors *"
  })

stevec · Accepted Answer · 2023-08-15 13:16:03Z

I had this problem after running RAILS_ENV=production rails server.

Localhost should still work as expected in incognito or in a browser other than chrome.

3 steps that solved it

Open the https://localhost:3000 (the https version) in incognito
Open dev tools (cmd + opt + j on mac)
Hard refresh the page. Do this by either cmd + shift + r or by holding shift and clicking the refresh button.
Now visit http://localhost:3000 (http version) and it should load as it normally would

This info is from here.

Notes

Once in the past I used a debugger in production and somehow got the same error. Here's what seemed to solve:

Put this in your address bar and hit enter:

chrome://settings/content/all?search=cookies

Look for the cookie(s) for the production website and delete them.
Visit localhost and see if works now
You have also have to close and reopen chrome.

Collectives™ on Stack Overflow

HTTP parse error, malformed request - Ruby on Rails

8 Answers 8

4 Comments

Comments

Comments

Comments

Comments

Comments

Comments

3 steps that solved it

Notes

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

8 Answers 8

4 Comments

Comments

Comments

Comments

Comments

Comments

Comments

3 steps that solved it

Notes

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related