How do I force SSL and also have a www domain URL redirect? - ruby-on-rails

Question

I have a domain running on example.com and https://example.com on Heroku. I have a URL redirect on my name server from www to https://example.com. I have config.force_ssl = true set in config/environment/production.rb. The domain URL redirect works only on http, not https. It works in Chrome the first time I type www.example.com. However it fails the 2nd time I use www.example.com. It gives a 'ERR_CONNECTION_REFUSED' with a 307 Internal Redirect.
Status Code: 307 Internal Redirect
Location: https://www.example.com/
Non-Authoritative-Reason: HSTS
This is despite the domain service always giving Location: https://example.com via curl. Where is Chrome getting https://www* from? I saw https://superuser.com/a/881431/130929 about deleting the HSTS entries from Chrome at chrome://net-internals/#hsts. If I do that for both example.com and www.example.com, then it works only the first time for www.example.com again. example.com and https://example.com always works. What's worse is that in Firefox, after loading the page, simply using example.com fails because Firefox automatically adds a https://www. How can I use HTTPS on the root domain and redirect www to the root domain? I don't care about handling https://www.example.com as no one would type that. They would only mistakenly type www.example.com.

Answer 1

OK I fixed it with this answer http://stackoverflow.com/questions/10629397/ddg#10632901
I saw in curl -i https://example.com that it was returning
Strict-Transport-Security: max-age=15552000; includeSubDomains
The max age is 6 months. includeSubDomains probably means to include www. So I added
class ApplicationController < ActionController::Base
before_action :disable_hsts_subdomains
def disable_hsts_subdomains
response.headers["Strict-Transport-Security"] = 'max-age=15552000;'
end
Which just removed includeSubDomains so it wouldn't try to redirect www without reaching out to the host first (DNS server), which would send the redirect to the proper root domain.