alphagov/sign-on-o-tron — comment on commit 8d0d17ee2f067aba4633273298624dc3389f5da3
File:  line 0
By tomafro:

I've done a little bit more debugging (live on site I'm afraid). It looks as though request.ssl? is returning false, preventing the cookie being set.

According to https://github.com/chneukirchen/rack/blob/master/lib/rack/request.rb#L70 a request is regarded as secure if it has a header set (such as `HTTP_X_FORWARDED_SSL`), or if the scheme is https.