SameSite attribute missing in cookies

[luma7]

Hi,
after migrating some application with activerecord-session_store from Rails 6.1.7 to 7.1.3.4, the SameSite attribute is missing in cookies:

curl -v http://localhost:3000
...
< set-cookie: _cta_session=9f0ec74db42eb11e0434f81fc257c348; path=/; httponly
...

I was expecting "SameSite=Lax" which is the default for Rails applications according to https://guides.rubyonrails.org/configuring.html#config-action-dispatch-cookies-same-site-protection:

< set-cookie: _cta_session=9f0ec74db42eb11e0434f81fc257c348; path=/; httponly; SameSite=Lax

It's the same issue with versions 2.0.0 and 2.1.0 of activerecord-session_store, and it's working with https://api.rubyonrails.org/classes/ActionDispatch/Session/CookieStore.html.

Steps to reproduce:

rails new cookies_test_app
cd cookies_test_app
rails generate controller Some

// app/controllers/some_controller.rb:
class SomeController < ApplicationController
  def index
    session[:something] = true
    render plain: "hi there"
  end
end

// add to config/routes.rb:
root "some#index"

// add to Gemfile:
gem 'activerecord-session_store'

// execute migrations
rails db:migrate

// config/session_store.rb:
CookiesTestApp::Application.config.session_store :active_record_store, key: '_cta_session', secure: Rails.env.production?

And then see "set-cookie" in the result of "curl -v http://localhost:3000".

[lcmen]

From my understanding an initializer needs to be added to ActionDispatch::Session::ActiveRecordStore class.

Similar to https://github.com/rails/rails/blob/main/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb#L64

def initialize(app, options = {})
  options[:same_site] = DEFAULT_SAME_SITE unless options.key?(:same_site)
  super
end

For the time being, I guess the workaround is to monkey patch the middleware?

# config/initializer/activerecord_session_store.rb
DEFAULT_SAME_SITE = proc { |request| request.cookies_same_site_protection }

ActionDispatch::Session::ActiveRecordStore.class_eval do
  def initialize(app, options = {})
    options[:same_site] = DEFAULT_SAME_SITE unless options.key?(:same_site)
    super
  end
end

[luma7]

That's working, thanks!

[stevenharman]

We're hitting this too and I agree with @lcmen - ActionDispatch::Session::ActiveRecordStore passes along whatever options it was configure with, and by default that DOES NOT include a :same_site value. So when Rack::Session::SessionId is created, it's defaulting :same_site to nil because the option is missing. That means, by the time ActionDispatch's cookie middleware runs, there is a :same_site key, so it won't set the default.

So yes, the monkey patch does work, or you could set the same_site: :lax (or whatever value you want) in your activerecord-session_store initializer.

[javinto]

Hi, in my Rails 7.2 and 8.0 applications I have

Rails.application.config.session_store :cookie_store, key: "my-session", httponly: true, secure: Rails.configuration.force_ssl, same_site: :none

This results in the Cookie I would expect: httponly; samesite=none

This works fine in production mode. However in local development (localhost:3000) my session store is not stored anymore! As a consequence I cannot login. It does not make any difference if I use ActiveRecord::Store or CookieStore.

I tested this with Firefox and Chrome.

If I set the SameSite to :lax it is working. Is this related as well or is this a browser issue?

[lcmen]

@javinto to make same_site: :none working, you need secure: true which means you need https for localhost.

You can use localhost gem to help with running Puma with https support localy. Don't forget to update puma config after installing the gem:

ssl_bind 'localhost', Integer(ENV.fetch('PORT', 3000) + 1) if get(:environment) == 'development'

[javinto]

Ah, okay, thank you for your quick response!

…

Op 3 apr 2025, om 17:17 heeft Lucas Mendelowski ***@***.***> het volgende geschreven: lcmen left a comment (rails/activerecord-session_store#214) @javinto to make same_site: :none working, you need secure: true which means you need https for localhost. You can use localhost gem to help with running Puma with https support localy. Don't forget to update puma config after installing the gem: ssl_bind 'localhost', Integer(ENV.fetch('PORT', 3000) + 1) if get(:environment) == 'development' — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned. <https://github.com/javinto> <https://github.com/socketry/localhost> <#214 (comment)> <https://github.com/notifications/unsubscribe-auth/AACY2NZSMHIKHTWKE5WE2PD2XVGG5AVCNFSM6AAAAABYJYVXEGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDONZWGE2DGOBQGA> lcmen left a comment (rails/activerecord-session_store#214) <#214 (comment)> @javinto <https://github.com/javinto> to make same_site: :none working, you need secure: true which means you need https for localhost. You can use localhost <https://github.com/socketry/localhost> gem to help with running Puma with https support localy. Don't forget to update puma config after installing the gem: ssl_bind 'localhost', Integer(ENV.fetch('PORT', 3000) + 1) if get(:environment) == 'development' — Reply to this email directly, view it on GitHub <#214 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACY2NZSMHIKHTWKE5WE2PD2XVGG5AVCNFSM6AAAAABYJYVXEGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDONZWGE2DGOBQGA>. You are receiving this because you were mentioned.