Share a Rails dev server

Share your Rails development server with a public HTTPS URL, with host checks and POST forms working.

Before you beginCopy Anchor Link

• Node.js 18 or later
• A Horizon account and the CLI (see Getting started)
• A reserved subdomain for -s. Reserve one on the Subdomains page.
• A Rails app you can run with bin/rails server

bin/rails server

hrzn tunnel http://localhost:3000 -s my-app

HORIZON: Tunnel connected
  URL          https://my-app.hrzn.run (reserved)
  Forwarding   http://localhost:3000
  Request log  https://hrzn.run/dashboard/tunnels/my-app

Rails.application.configure do
  config.hosts << "my-app.hrzn.run"
end

Check it worksCopy Anchor Link

Open https://my-app.hrzn.run in a browser. On the first visit Horizon shows a Before you continue page. Select Continue to site. Your app renders instead of the Rails host error.

Then submit a form. The Horizon terminal prints one line per request:

  GET     200  /
  POST    302  /sessions

TroubleshootingCopy Anchor Link

Blocked hosts: my-app.hrzn.runCopy Anchor Link

Rails shows this page, with a 403 status, when the host isn't in config.hosts. The page lists the exact line to add, config.hosts << "my-app.hrzn.run". Add it to config/environments/development.rb and restart the server.

HTTP Origin header (https://my-app.hrzn.run) didn't match request.base_urlCopy Anchor Link

With forgery_protection_origin_check on, Rails compares the Origin header of a POST with request.base_url. Rails builds base_url from X-Forwarded-Host and the scheme it sees. The two differ when the app sees http instead of https, for example request.base_url (http://my-app.hrzn.run).

For development, turn the origin check off. The authenticity token check stays on.

Rails.application.configure do
  config.action_controller.forgery_protection_origin_check = false
end

Restart the server. Leave the setting on in production.

Can't verify CSRF token authenticityCopy Anchor Link

The form's token doesn't match the session. Reload the form through the public URL, so the session cookie and the token come from the same site.

Nothing reaches your appCopy Anchor Link

• Check that the Horizon terminal is still running. If its last line is Connection lost. Reconnecting…, wait for Reconnected.
• Check that Rails listens on port 3000, the port in your hrzn tunnel command.

Next stepsCopy Anchor Link

• Read the Rails guide on host authorization.
• Share a different stack: Django or Laravel.