That's true. And yes, devise doesn't do that by default. Basically, you'll want to have Devise (or better yet, all of Rails) set to only use secure cookies.

That's true. And yes, devise doesn't do that by default. Basically, you'll want to have Devise (or better yet, all of Rails) set to only use secure cookies. Unfortunately, most Rails apps run without SSL, so that's not going to be the default any year soon. At this point, you really do have to pay money for a good SSL certificate, or self-sign and then people have to click through an ominous-looking dialog to use your site.