title: Adding secure tag to rails 5.2.x API only session cookies
body: <p>I am using a rails API only setup for a project.
  I have managed to get it to use custom cookie information, however I CANNOT seem to get it to add the secure tag even though in production the server is on an HTTPS connection.</p>
  <p>This is causing my cookies to not get saved since the api is not on the same url as the front end.</p>
  <p>here is the setup for the cookies</p>
  <pre><code>    config.middleware.use ActionDispatch::Cookies
  config.middleware.use ActionDispatch::Session::CookieStore
  
  config.middleware.insert_after ActionDispatch::Cookies, ActionDispatch::Session::CookieStore, :key =&gt; '_session_id', same_site: :none, secure: :true, expire_after: 14.days, httponly: true
  </code></pre>
  <p>I also tried secure: Rails.env.production? to no success</p>
  <p>For reference here is the session controller:</p>
  <pre><code>class SessionsController &lt; ApplicationController
  def create
      @user = User.find_by(email: session_params[:email])
  
      if @user &amp;&amp; @user.authenticate(session_params[:password])
          login!
          render json: {
              logged_in: true,
              user: @user
          }
          response.set_header('Set-Cookie', 'Secure; SameSite=None')
  
      else
          render json: {
              status: 401,
              errors: ['no such user', 'verify credentials and try again']
          }
      end
  end
  
  def is_logged_in?
      if logged_in? &amp;&amp; current_user
          render json: {
              logged_in: true,
              user: current_user
          }
      else
          render json: {
              logged_in: false,
              message: 'no session found'
          }
      end
  end
  
  def destroy
      logout!
      render json: {
          status: 200,
          logged_out: true
      }
  end
  
  private
  
  def session_params
      params.require(:user).permit(:username, :email, :password)
  end
  </code></pre>
  <p>end</p>
  <p>Image added for comment:</p>
  <p><a href="https://i.stack.imgur.com/06ASW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/06ASW.png" alt="enter image description here" /></a></p>
  <p><a href="https://i.stack.imgur.com/D6GGp.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/D6GGp.png" alt="enter image description here" /></a></p>