Cookie session state shared across http and https without disabling force_secure_cookies

[kbaum]

Due to issues out of our control right now, I have some logged in pages that are https and some that are http. After reading through the github readme, it would seem that i would have to disable force_secure_cookies for this to function properly.

https://github.com/tobmatth/rack-ssl-enforcer#secure-cookies-disabling

That being said I am able to jump between logged in http and https pages without being logged out. My configuration looks like:

config.middleware.use Rack::SslEnforcer, only: ['/users/sign_in', %r{/users/password/*}, %r{^/user_profile.*}], ignore: [%r{^/assets}], strict: true 

Am I misinterpreting the readme?

thx!

[ianneub]

I noticed that Rack::SslEnforcer will not set cookies to be secure on Rails 3.2 or Rails 4 (maybe others too). I'm guessing that functionality is not actually implemented for Rails > 3.1?

Here is my config:
config.middleware.use Rack::SslEnforcer, :hsts => true

I wanted to turn on secure cookies in rails, so I had to add this line as well:
config.force_ssl = true

[rymai]

Strange, cookies are flagged as secure by default unless you set the option :force_secure_cookies to false. See the implementation here: https://github.com/tobmatth/rack-ssl-enforcer/blob/master/lib/rack/ssl-enforcer.rb#L169-L180

@ianneub that's weird since rack-ssl-enforcer's implementation and the rack-ssl one are quite similar.

[sslotnick]

You have to be careful about where the middleware is inserted. The default instructions will insert it toward the bottom. I found that you need to insert it before ActionDispatch::Cookies in order for secure cookies to work properly.

Non-secure cookies:
config.middleware.insert_after ActionDispatch::Cookies, Rack::SslEnforcer

Secure cookies:
config.middleware.insert_before ActionDispatch::Cookies, Rack::SslEnforcer

[rymai]

Interesting, thanks for the tip! @kbaum please ensure Rack::SslEnforcer comes before ActionDispatch::Cookies in your middleware stack.

[tobmatth]

@kbaum I'm closing here. Please reopen if needed.