# Does session\_secure work?

**URL:** <https://discuss.rubyonrails.org/t/does-session-secure-work/49077>\
**Category:** rubyonrails-talk\
**Created:** [February 3, 2010, 2:08am UTC](https://discuss.rubyonrails.org/t/does-session-secure-work/49077 "2010-02-03T02:08:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![CNK](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@CNK](https://discuss.rubyonrails.org/u/CNK)\
**Post date:** [February 3, 2010, 2:08am UTC](https://discuss.rubyonrails.org/t/does-session-secure-work/49077/1 "2010-02-03T02:08:40Z")

</div>

I am trying to get session cookies set so they are only returned over ssl connections. I looked in AWDWR and see there is a parameter :session\_secure. The book says ‘If true, sessions will be enabled only over https://’ The example code in that section of the book shows:

class ApplicationController \< ActionController::Base session :session\_key =\> ‘somekey\_text’ end

So I tried setting session :session\_secure =\> true in ApplicationController. No change.

I found this post [http://www.rorsecurity.info/journal/2007/4/12/session-hijacking.html](http://www.rorsecurity.info/journal/2007/4/12/session-hijacking.html) on session hijacking that suggested:

To instruct the browser only to send the cookie over encrypted HTTPS and never over normal HTTP, you have to include the following line in the confg/environment.rb file.

ActionController::Base.session\_options[:session\_secure] = true

I tried that (and yes, restarted my server) but no change. My Rails version is 2.3.5

I am trying to verify things by looking at the cookie information in the Firefox preferences pane. I have some cookies that report “Send For: Encrypted connections only” but no matter what I set in my rails app, that cookie says “Send For: Any type of connection”.

Don’t think it should matter, but I am testing with Apache2 proxying to Mongrel. My production hosting will be Apache + passenger.

This is driving me mad. Thanks in advance,

---

<div class="post-metadata">

**Author:** ![Frederick\_Cheung](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/frederick_cheung/32/3901_2.png) [@Frederick\_Cheung](https://discuss.rubyonrails.org/u/Frederick_Cheung)\
**Post date:** [February 3, 2010, 8:22am UTC](https://discuss.rubyonrails.org/t/does-session-secure-work/49077/2 "2010-02-03T08:22:33Z")

</div>

The names of the session options changed in 2.3. Try just :secure instead

Fred

---

<div class="post-metadata">

**Author:** ![CNK](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@CNK](https://discuss.rubyonrails.org/u/CNK)\
**Post date:** [February 3, 2010, 10:34pm UTC](https://discuss.rubyonrails.org/t/does-session-secure-work/49077/3 "2010-02-03T22:34:53Z")

</div>

> The names of the session options changed in 2.3. Try just :secure
> 
> instead

Thank you Fred. That was just the ticket! In config/environment.rb:

ActionController::Base.session\_options[:secure] = true

---

<div class="post-metadata">

**Author:** ![11155](https://avatars.discourse-cdn.com/v4/letter/1/d26b3c/32.png) [@11155](https://discuss.rubyonrails.org/u/11155)\
**Post date:** [October 30, 2012, 8:09pm UTC](https://discuss.rubyonrails.org/t/does-session-secure-work/49077/4 "2012-10-30T20:09:17Z")

</div>

I tried ActionController::Base.session\_options[:secure] = true and the session cookie is not set at all. If I set it to false everything works fine but if it's true the server never sets the cookie even if the request is over https (although my understanding is that it should set it anyway)