Support token header for health check token, and general cleanup of the health_check feature.

app/controllers/health_check_controller.rb

 class HealthCheckController < HealthCheck::HealthCheckController
   before_action :validate_health_check_access!
-  protected
+  private
   def validate_health_check_access!
-    return render_404 unless params[:token].presence && params[:token] == current_application_settings.health_check_access_token
+    render_404 unless token_valid?
+  end
+
+  def token_valid?
+    token = params[:token].presence || request.headers['TOKEN']
+    token.present? &&
+      ActiveSupport::SecurityUtils.variable_size_secure_compare(
+        token,
+        current_application_settings.health_check_access_token
+      )
   end
   def render_404
-    render file: Rails.root.join("public", "404"), layout: false, status: "404"
+    render file: Rails.root.join('public', '404'), layout: false, status: '404'
   end
 end

app/views/admin/health_check/show.html.haml

@@ -2,29 +2,35 @@
 %h3.page-title
   Health Check
-%p.light
-  Access token is
-  %code{ id:'health-check-token' }= "#{current_application_settings.health_check_access_token}"
-%p.light
-  Health information can be reteived as plain text, json, or xml using:
-  %ul
-    %li
-      %code= "/health_check?token=#{current_application_settings.health_check_access_token}"
-    %li
-      %code= "/health_check.json?token=#{current_application_settings.health_check_access_token}"
-    %li
-      %code= "/health_check.xml?token=#{current_application_settings.health_check_access_token}"
-
 .bs-callout.clearfix
   .pull-left
     %p
-      You can reset the health check access token by pressing the button below.
-    %p
+  Access token is
+  %code#health-check-token= current_application_settings.health_check_access_token
   = button_to reset_health_check_token_admin_application_settings_path,
     method: :put, class: 'btn btn-default',
     data: { confirm: 'Are you sure you want to reset the health check token?' } do
     = icon('refresh')
     Reset health check access token
+%p.light
+  Health information can be reteived as plain text, json, or xml using:
+  %ul
+    %li
+      %code= health_check_url(token:current_application_settings.health_check_access_token)
+    %li
+      %code= health_check_url(token:current_application_settings.health_check_access_token, format: :json)
+    %li
+      %code= health_check_url(token:current_application_settings.health_check_access_token, format: :xml)
+
+%p.light
+  You can also ask for the status of specific services:
+  %ul
+    %li
+      %code= health_check_url(token:current_application_settings.health_check_access_token, checks: :cache)
+    %li
+      %code= health_check_url(token:current_application_settings.health_check_access_token, checks: :database)
+    %li
+      %code= health_check_url(token:current_application_settings.health_check_access_token, checks: :migrations)
 %hr
 .panel.panel-default

config/routes.rb

@@ -74,7 +74,7 @@ Rails.application.routes.draw do
   end
   # Health check
-  get 'health_check(/:checks)(.:format)'  => 'health_check#index'
+  get 'health_check(/:checks)'  => 'health_check#index', as: :health_check
   # Enable Grack support
   mount Grack::AuthSpawner, at: '/', constraints: lambda { |request| /[-\/\w\.]+\.git\//.match(request.path_info) }, via: [:get, :post, :put]

spec/controllers/health_check_controller_spec.rb

@@ -14,6 +14,13 @@ describe HealthCheckController do
     end
     context 'when services are up and an access token is provided' do
+      it 'supports passing the token in the header' do
+        request.headers['TOKEN'] = token
+        get :index
+        expect(response).to be_success
+        expect(response.content_type).to eq 'text/plain'
+      end
+
       it 'supports successful plaintest response' do
         get :index, token: token
         expect(response).to be_success
@@ -55,6 +62,14 @@ describe HealthCheckController do
         allow(HealthCheck::Utils).to receive(:process_checks).with('email').and_return('Email is on fire')
       end
+      it 'supports passing the token in the header' do
+        request.headers['TOKEN'] = token
+        get :index
+        expect(response.status).to eq(500)
+        expect(response.content_type).to eq 'text/plain'
+        expect(response.body).to include('The server is on fire')
+      end
+
       it 'supports failure plaintest response' do
         get :index, token: token
         expect(response.status).to eq(500)