rails/rails — pull request #7879 by dosire (2012-10-09 09:04:24+00:00)
Title: Use secure default values for the session store.

This improves security by complying with OWASP recommendations: https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Rule-Use.22Secure.22_Cookie_Flag

If administrators enable config.force_ssl this code automatically tells clients to only send cookies over SSL. If config.force_ssl is not set there will be no effect.

The problem this solves is that when you force SSL to be true you might forget to set your cookies to HTTPS only. If you forget to do this then your cookies are vulnerable when your users are on a unsafe connection, for example public wifi. This attack happens in the wild with Firesheep (http://codebutler.com/firesheep/). You can read more about this attack at http://en.wikipedia.org/wiki/HTTP_cookie#Cookie_theft_and_session_hijacking

Of course some people will remember and configure the cookie correctly to prevent this attack. However I feel it is important to be secure by default. Default in this case means when a user forces SSL, if that is not set this PR will not change anything.