diaspora/diaspora — comment on commit 98bdf680034e531ca7006bb4c39662bcb50b053e
File:  line 0
By maxwell:

Its not actually about being before the cookies. The problem is that you need to guarantee that SSL is loaded BEFORE both cookies, and more importantly, static assets. In this current configuration, if static assets are turned on, they are not upgraded to SLL as they are served before the SSL is processed.

Here is my current middleware stack from a production instance servering static assets:
"use ActionDispatch::Static
use ActiveSupport::Cache::Strategy::LocalCache
use Rack::Runtime
use Rails::Rack::Logger
use ActionDispatch::ShowExceptions
use ActionDispatch::RemoteIp
use Rack::Sendfile
use ActionDispatch::Callbacks
use ActiveRecord::ConnectionAdapters::ConnectionManagement
use ActiveRecord::QueryCache
use Rack::SSL
use ActionDispatch::Cookies
use ActionDispatch::Session::CookieStore
use ActionDispatch::Flash
use ActionDispatch::ParamsParser
use Rack::MethodOverride
use ActionDispatch::Head
use ActionDispatch::BestStandardsSupport
use Warden::Manager
use ClientSideValidations::Middleware::Validators
use Sass::Plugin::Rack
use OAuth2::Provider::Rack::Middleware
use Rack::MobileDetect
use Rack::GoogleAnalytics
use Rack::Piwik
use OmniAuth::Builder
run Diaspora::Application.routes"

This is not good.