Need to be able to send secure session cookie for localhost

Open
#40 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
55/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
ruby
Domain
authentication, backend

Research direction

Start in lib/rack/session/abstract/id.rb and inspect security_matches? to understand how secure cookies are currently limited to SSL requests. Verify the localhost behavior described in the issue while preserving the existing secure-cookie restriction for other hosts, then check the relevant session tests.

Written by the indexing model from the issue text.

Description

Right now, unless it is ssl, you can't send a secure session cookie. It is perfectly valid to do this for localhost, and very desirable for development.

In lib/rack/session/abstract/id.rb, I think it should say something like:

def security_matches?(request,options)
return true unless options[:secure]
request.ssl? || request.host == "localhost"
end

Dominant language
Ruby
Stars
52
Forks
22
Avg merge
2d 22h
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rack/rack-session

All issues in rack/rack-session

Similar issues

More Ruby issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.