As far as I'm Rails doesn't use secure-flag cookies by default; you need to have something like this in config/initializers/session_store.rb:

  local_env = !(Rails.env.test? || Rails.env.development?)
  MyApp::Application.config.session_store(:cookie_store, {
    key:    '_my_app_session',
    secure: local_env, # ... or just true
  })

Yes, somebody who has gone looking for this can find it, but I'd argue that Rails should at least give you the secure: ... option in a comment block. Anything less is just inviting people to get bitten by the lack of it.