# Rails 2.2.3 secure/http\_only session cookie

**URL:** <https://discuss.rubyonrails.org/t/rails-2-2-3-secure-http-only-session-cookie/70075>\
**Category:** rubyonrails-talk\
**Created:** [December 30, 2014, 9:45pm UTC](https://discuss.rubyonrails.org/t/rails-2-2-3-secure-http-only-session-cookie/70075 "2014-12-30T21:45:14Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![11155](https://avatars.discourse-cdn.com/v4/letter/1/d26b3c/32.png) [@11155](https://discuss.rubyonrails.org/u/11155)\
**Post date:** [December 30, 2014, 9:45pm UTC](https://discuss.rubyonrails.org/t/rails-2-2-3-secure-http-only-session-cookie/70075/1 "2014-12-30T21:45:14Z")

</div>

I'm way behind the times.

I've finally got the go ahead from corporate to start an upgrade of our ROR application from 1.2.6.

I'm first upgrading to Rails 2.2.3 which has not been too bad but I have a question around http\_only and secure session cookie using :active\_record\_store.

I understand that :session\_http\_only by default is set to TRUE but it appears to be ignored while :session\_secure is FALSE.

I'm using this at the bottom of environment.rb to turn on the secure flag. ActionController::Base.session\_options[:session\_secure] = true

When secure is turned off (FALSE) I CAN access the session cookie via javascript in the browser. When secure is turned on (TRUE) I CANNOT access the session cookie via javascript.

This does not apply to other cookies - just the session cookie.

\<P\>Was this a known issue?