Cookie session state shared across http and https without disabling force_secure_cookies

[tobmatth]

Cookie session state shared across http and https without disabling force_secure_cookies

[ianneub]

I noticed that Rack::SslEnforcer will not set cookies to be secure on Rails 3.2 or Rails 4 (maybe others too). I'm guessing that functionality is not actually implemented for Rails > 3.1?

Here is my config:
config.middleware.use Rack::SslEnforcer, :hsts => true

I wanted to turn on secure cookies in rails, so I had to add this line as well:
config.force_ssl = true

[rymai]

Strange, cookies are flagged as secure by default unless you set the option :force_secure_cookies to false. See the implementation here: https://github.com/tobmatth/rack-ssl-enforcer/blob/master/lib/rack/ssl-enforcer.rb#L169-L180

@ianneub that's weird since rack-ssl-enforcer's implementation and the rack-ssl one are quite similar.

[sslotnick]

You have to be careful about where the middleware is inserted. The default instructions will insert it toward the bottom. I found that you need to insert it before ActionDispatch::Cookies in order for secure cookies to work properly.

Non-secure cookies:
config.middleware.insert_after ActionDispatch::Cookies, Rack::SslEnforcer

Secure cookies:
config.middleware.insert_before ActionDispatch::Cookies, Rack::SslEnforcer

[rymai]

Interesting, thanks for the tip! @kbaum please ensure Rack::SslEnforcer comes before ActionDispatch::Cookies in your middleware stack.

[tobmatth]

@kbaum I'm closing here. Please reopen if needed.