Does not set session cookie as secure

[vipulvkp]

Hi
Below are the things I did:

1. Installed rack-ssl-enforcer gem
2. In config/environment.rb (I have a Rails 2.3.2 app) added below two lines:
   require 'rack/ssl-enforcer'
   config.middleware.use Rack::SslEnforcer
3. Configured my web server(i.e. Apache) to send HSTS response header.

But still my session_id is not set as secure as verified in chrome developer console.

[tobmatth]

You need to enable HSTS:

config.middleware.insert_before  ActionDispatch::Cookies, Rack::SslEnforcer, hsts: true

[vipulvkp]

Hi
I think I found the issue.
Instead of config.middleware.insert_before ActionDispatch::Cookies, Rack::SslEnforcer, :hsts=>true

I added the below:

config.middleware.insert_before ActionController::Session::CookieStore, Rack::SslEnforcer, :hsts => true

I have a Rails 2 application. If I use the above (ActionDispatch), code crashes saying "Could not find ActionDispatch)

[tobmatth]

Guess you are right, have to inspect the Middleware stack für Rails 2.x applications. Thanks for getting back, i'm closing here...

[vipulvkp]

Hey,

Can we change the path of the cookie using this gem?

Regards,
Vipul

[tobmatth]

No, you can only configure if HSTS headers are set for subdomains or not, see
https://github.com/tobmatth/rack-ssl-enforcer/blob/master/lib/rack/ssl-enforcer.rb#L197

What would be the Use-Case for this?

[vipulvkp]

If the path is set to the root directory ""/“, an attacker can access other cookies of the sub domain which are available under the parent domain.

It is recommended to set the value of the “path” attribute to the actual virtual directory path of the application.

I