From cc2b76f7e43f33e15f5cdf84d8d8665188a0c607 Mon Sep 17 00:00:00 2001
From: rhymes <rhymes@hey.com>
Date: Wed, 10 Mar 2021 16:45:48 +0100
Subject: [PATCH] Adopt session cookie configuration for remember me cookie
 (#12938)

---
 config/initializers/devise.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index b17b928f3..9493bfb32 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -211,7 +211,7 @@ Devise.setup do |config|
 
   # Options to be passed to the created cookie. For instance, you can set
   # secure: true in order to force SSL only cookies.
-  # config.rememberable_options = {}
+  config.rememberable_options = { secure: ApplicationConfig["FORCE_SSL_IN_RAILS"] == "true", same_site: :lax }
 
   # ==> Configuration for :validatable
   # Range for password length.