How can I make cookies secure (https-only) by default in rails?

Question

In a Rails controller, I can set a cookie like this:

cookies[:foo] = "bar" 

And specify that the "secure" (https-only) flag be on like this:

cookies[:foo, :secure => true] = "bar" 

:secure is false by default. How can I have cookies be secure by default, application-wide?

This is on Rails 2.3.8

Answer 1

There's no need to monkeypatch ActionController/ActionDispatch, and force_ssl has side effects (e.g. when behind an ELB).

The most straightforward way to achieve secure cookies is to modify config/initializers/session_store.rb:

MyApp::Application.config.session_store(    :cookie_store,    key: '_my_app_session',   secure: Rails.env.production? ) 

Answer 2

starting with rails 3.1, according to the rails security guide, you can simply set the following in your application.rb:

config.force_ssl = true 

this forces the cookie to be sent over https only (and I assume everything else, too).