> Especially when cookies are easily stolen using something like Firesheep
Who in late 2013 (with enough clue to care about this issue) is still using non-secure-flag cookies for anything even remotely important?!
Who in late 2013 (with enough clue to care about this issue) is still using non-secure-flag cookies for anything even remotely important?!
local_env = !(Rails.env.test? || Rails.env.development?)
MyApp::Application.config.session_store(:cookie_store, {
key: '_my_app_session',
secure: local_env, # ... or just true
})