1

I am using :active_record_store for session_store in Rails 4.1.1 application. I need to make session cookie secure (HTTPS only) in my application. Tried below code in development enviroment, but did not work for me.

MyApp::Application.config.session_store :session_store, key: '_session_id', secure: true

config.force_ssl = true: makes all cookie(s) as secure whcih is not  requirement.

How can I set Secure flag for cookie by default in application configuration so that it instructs the browser that the cookie can only be accessed over secure SSL channels?

rink.attendant.6
  • 44,500
  • 61
  • 101
  • 156
Khaja Bhanu Mohd
  • 41
  • 6

1 Answers1

1

To flag the session cookie as secure you can do this,

MyApp::Application.config.session_store :cookie_store,
  key: "_session_id",
  secret: "your_secret",
  secure: Rails.env.development?,
  httponly: true

config.session_store is usually set up in config/initializers/session_store.rb and specifies what class to use to store the session. Possible values are :cookie_store which is the default, :mem_cache_store, and :disabled. The last one tells Rails not to deal with sessions.

Kedarnag Mukanahallipatna
  • 2,249
  • 1
  • 11
  • 16