Search code examples
sessioncookiessinatrarack

Sinatra set SameSite cookies to none

I have a modular sinatra app with this in the configuration:

configure do
        disable :protection
        use Rack::Protection
        enable :sessions
        set :session_secret, ENV.fetch('SESSION_SECRET') { SecureRandom.hex(64) }
        set (:cookie_options) do {          
            :SameSite => "Lax",
            :expires => Time.now + 1.month, 
            :secure => true
        }
      end
end

The line :secure => true works fine but SameSite doesn't. I don't see how to change this.

Also: I don't see how to set the Rack Session cookie to secure: true

Solution

  • Very late answer, but I was in the same boat and it looks like the relevant option that works for me is :same_site.

    set :cookie_options do
  {
    :same_site => :lax # or :strict
    ...
  }
end