title: Set "secure" flag on session cookie in RoR even over HTTP
body: <p>In a Rails app, the session cookie can be easily set to include the <code>secure</code> cookie attribute, when sending over HTTPS to ensure that the cookie is not leaked over a non-HTTP connection.   </p>
  
  <p>However, if the Rails app is NOT using HTTPS, but HTTP only, it seems that it doesnt even set the cookie at all.<br>
  While this does make some sense, in this scenario there is a seperate front end load balancer, which is responsible for terminating the SSL connection. From the LB to the Rails app, the connection is HTTP only.   </p>
  
  <p>How can I force the Rails app to set a <code>secure</code> cookie, even when not using HTTPS?  </p>