Set secure flag for remember_me cookie

CHANGELOG.md

@@ -1,6 +1,10 @@
 # Changelog
 ## HEAD
 
+## 0.16.3
+
+* Add secure flag for remember_me cookie [#295](https://github.com/Sorcery/sorcery/pull/295)
+
 ## 0.16.2
 
 * Inline core migration index definition [#281](https://github.com/Sorcery/sorcery/pull/281)

lib/generators/sorcery/templates/initializer.rb

@@ -31,6 +31,11 @@
   #
   # config.remember_me_httponly =
 
+  # Set secure flag for remember_me cookie
+  # Default: `false`
+  #
+  # config.remember_me_secure =
+
   # Set token randomness. (e.g. user activation tokens)
   # The length of the result string is about 4/3 of `token_randomness`.
   # Default: `15`

lib/sorcery/controller/submodules/remember_me.rb

@@ -10,9 +10,9 @@ def self.included(base)
           base.send(:include, InstanceMethods)
           Config.module_eval do
             class << self
-              attr_accessor :remember_me_httponly
+              attr_accessor :remember_me_httponly, :remember_me_secure
               def merge_remember_me_defaults!
-                @defaults.merge!(:@remember_me_httponly => true)
+                @defaults.merge!(:@remember_me_httponly => true, :@remember_me_secure => false)
               end
             end
             merge_remember_me_defaults!
@@ -71,7 +71,8 @@ def set_remember_me_cookie!(user)
               value: user.send(user.sorcery_config.remember_me_token_attribute_name),
               expires: user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name),
               httponly: Config.remember_me_httponly,
-              domain: Config.cookie_domain
+              domain: Config.cookie_domain,
+              secure: Config.remember_me_secure
             }
           end
         end