From 4e158b23165718b71fb29ca7904951dcd596bc03 Mon Sep 17 00:00:00 2001
From: Neil Lalonde <neillalonde@gmail.com>
Date: Thu, 30 Jan 2014 17:06:45 -0500
Subject: [PATCH] Add secure flag to cookie
---
config/initializers/session_store.rb | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
index 2a14105c920..62cb121a056 100644
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -1,6 +1,9 @@
# Be sure to restart your server when you modify this file.
-Discourse::Application.config.session_store :cookie_store, key: '_forum_session'
+Discourse::Application.config.session_store :cookie_store, {
+ key: '_forum_session',
+ secure: SiteSetting.use_https
+}
# Use the database for sessions instead of the cookie-based default,
# which shouldn't be used to store highly confidential information