# Be sure to restart your server when you modify this file.
#
# Cookie Secure solo con FORCE_SSL/SESSION_COOKIE_SECURE.
# Dietro NPM→Caddy→Rails (HTTP interno) request.ssl? è false: con secure:true
# Rails non emette _simplecrm_session → CSRF 422 al login su HTTPS.
secure_cookie = ENV["FORCE_SSL"] == "true" || ENV["SESSION_COOKIE_SECURE"] == "true"

Rails.application.config.session_store :cookie_store,
                                       key: "_simplecrm_session",
                                       secure: secure_cookie,
                                       httponly: true,
                                       same_site: :lax