Redmine

You can set all these things as you desire in the config/initializers/session_store.rb, mine says:

# This file was generated by 'rake config/initializers/session_store.rb',
# and should not be made visible to public.
# If you have a load-balancing Redmine cluster, you will need to use the
# same version of this file on each machine. And be sure to restart your
# server when you modify this file.

# Your secret key for verifying cookie session data integrity. If you
# change this key, all old sessions will become invalid! Make sure the
# secret is at least 30 characters and all random, no regular words or
# you'll be exposed to dictionary attacks.
ActionController::Base.session = {
  :session_key => '_redmine_session',
  #
  # Uncomment and edit the :session_path below if are hosting your Redmine
  # at a suburi and don't want the top level path to access the cookies
  #
  # See: http://www.redmine.org/issues/3968
  #
  # :session_path => '/url_path_to/your/redmine/',
  :secret => '<edited-key>'
}

So the sub-uri and the distributed setup points are addressed in the comments, you can still set the :secure option by hand if you need, but the cookies are encrypted and signed, I doubt anyone could read or change them to anything meaningful if your :secret is long enough.

As to making any of these options DB-driven: it won't work because you'd have to already have a working config to get to the administration page to set them, it would add complexity and DB-calls to the startup, and I'm not even sure you could call the DB at the point where this stuff needs to get set.

Closing this as invalid because I don't see the feasibility of this, nor the motivation as it is already taken care in the docs of the proper files.

Felix Schäfer wrote:

You can set all these things as you desire in the config/initializers/session_store.rb, mine says:

[...]

So the sub-uri and the distributed setup points are addressed in the comments, you can still set the :secure option by hand if you need, but the cookies are encrypted and signed, I doubt anyone could read or change them to anything meaningful if your :secret is long enough.

That true... For the session cookie.... But I opened this issue specifically for the autologin cookie which is not yet configurable IMHO.

r4756 makes the autologin cookie configurable in the application configuration file (see #7408).