Set cookie cookie as safe on rails

Question

I have a Rails application that runs on https. My app session cookies are only http-only. How to set these cookies as secure and https-only in rails?

Answer 1

Rails 3/4

If you want to mark the session cookie as safe, config/initializers/session_store.rbset the safe flag to:

Demo::Application.config.session_store :cookie_store,
  key: '_demo_session',
  secret: "your secret",
  secure: Rails.env.production?, # flags cookies as secure only in production
  httponly: true # should be true by default for all cookies

If you want to mark all cookies as safe, add them config.force_ssl = trueto the desired file config/environments/*.rb. This feature adds other features to your Rails application, summing up here .