CODEWITHSUNDEEP
ruby-on-railssessioncookieshttponly
kingjeffrey
kingjeffrey

Reputation: 15270

How do I set the session cookie's HttpOnly setting to false?

In Ruby on Rails, how do I set the session cookie's httpOnly setting to false?

Upvotes: 18

Views: 9952

Answers (4)

troelskn
troelskn

Reputation: 117487

In Rails 4, you need to edit config/initializers/session_store.rb

Rails.application.config.session_store(
  :cookie_store,
  key: '_socializus_session',
  httponly: false,
)

Upvotes: 10

kingjeffrey
kingjeffrey

Reputation: 15270

I figured this out. In /config/environment.rb include this code:

  config.action_controller.session = {
    :httponly => false
  }

Upvotes: 6

ilgam
ilgam

Reputation: 4420

Rails has it set by default to true. I don't recommend to change it because it will set you cookies accessable for changing from JS like: document.cookie

In Rails 3+ you can change your cookies configuration from config/initializers/session_store.rb:

# Be sure to restart your server when you modify this file.
Rails.application.config.session_store :cookie_store, key: "_my_application_session", httponly: false

Upvotes: 1

sailor
sailor

Reputation: 8034

This is how i did it with Rails 3:

Testapp::Application.config.session_store :cookie_store, key: '_testapp_session', :domain => :all, :httponly => false

Upvotes: 7

Related Questions