title: Why would Rails 5.2 cookies not reach the browser on a development environment?
body: <p>Your help is hugely appreciated and valued. Thank you in advance if you take some of your time to read this issue and eventually respond.</p>
  
  <p>I'm working with a standard authentication system storing a user_id and remember_token in cookies.
  When filling-in a login form, a new token gets generated for this user, and stored in cookies as such:</p>
  
  <pre><code># Remembers a user in a persistent session.
    def remember(user)
      user.remember      # Generates a remember token + digest and saves the digest on the user side
      cookies.signed.permanent[:user_id] = user.id
      cookies.permanent[:remember_token] = user.remember_token
    end
  </code></pre>
  
  <p>I noticed the issue when after submitting the form with correct login information, the user always got redirected immediately back to the login page.</p>
  
  <p>This is because the user_id and remember_token were nil when reaching the action following sessions#create. They also did not appear in the console of the browser (tried on Safari and Chrome with identical results). I thought the cookies were lost during the redirect.</p>
  
  <p>But playing further, I included attempts to write cookies directly on a regular 'get' action, before any redirect:</p>
  
  <pre><code>class SessionsController &lt; ApplicationController
  
    def new
      cookies[:hello] = {value: 'store_me_please', expires: 10.years.from_now}
      cookies.permanent[:a_true_cookie] = true
      cookies.permanent.signed[:remember_me] = 123
      session[:hello] = 'store_me_in_session_please'
  
      if logged_in?
        redirect_to user_path(current_user)
      else
        render layout: "unauthenticated"
      end
    end
  end
  </code></pre>
  
  <p>And noticed that the cookie store in the browser would remain invariably empty while accessing the action. Nothing would get written.</p>
  
  <p>I thought it could be caused by a csrf protection problem as rails can clear the session if it fails to authenticate its token. So I commented out "protect_from_forgery" in the application_controller, but saw no change. </p>
  
  <p>The secret_key_base seems to be in place in the new credentials.yml file; although it's the first Rails 5.2 App for which I deal with such issues, so I could be missing something in the configuration.</p>
  
  <p>I also added the following configuration line to application.rb, which then triggers a "ActionController::InvalidAuthenticityToken" exception on submitting the form, despite the "#protect_from_forgery with: :exception" line being commented out.</p>
  
  <pre><code>config.session_store :cookie_store
  </code></pre>
  
  <p>It seems to me that the cookies are never sent out by the Rails App to the browser. What could cause this behavior?</p>