diff --git a/simple-session.cabal b/simple-session.cabal
--- a/simple-session.cabal
+++ b/simple-session.cabal
@@ -1,5 +1,5 @@
 name:                simple-session
-version:             0.10.0.0
+version:             0.10.1.0
 synopsis:            Cookie-based session management for the Simple web framework
 description:
 
@@ -52,6 +52,7 @@
     , simple >= 0.10
     , transformers
     , wai >= 3.0
+    , wai-extra >= 3.0
   default-language:    Haskell2010
 
 source-repository head
diff --git a/src/Web/Simple/Session.hs b/src/Web/Simple/Session.hs
--- a/src/Web/Simple/Session.hs
+++ b/src/Web/Simple/Session.hs
@@ -1,3 +1,4 @@
+{-# LANGUAGE Trustworthy #-}
 {-# LANGUAGE FlexibleInstances #-}
 {-# LANGUAGE OverloadedStrings #-}
 
@@ -38,6 +39,7 @@
 import Network.HTTP.Types.Header
 import Network.HTTP.Types.URI
 import Network.Wai.Internal (Response(..))
+import Network.Wai.Request (appearsSecure)
 import Web.Cookie
 import Web.Simple.Controller
 import System.Environment
@@ -46,15 +48,24 @@
 -- 'S.ByteString's.
 type Session = Map S.ByteString S.ByteString
 
--- | Instances of this class can be used as states by a 'Controller' states
--- to manage cookie-based user sessions. Instances must minimally implement
--- 'getSession' and 'setSession'. By default, the secret session key is taken
--- from the environment variable \"SESSION_KEY\", or a default dummy key is
--- used if the environment variable \"ENV\" is set to \"development\". You can
--- override this behaviour by implementing the 'sessionKey' method.
--- If the controller state contains a dedicated field of type 'Maybe Session',
--- a reasonable implementation would be:
+-- | Instances of this class can be used as states by a 'Controller' to manage
+-- cookie-based user sessions. Instances must minimally implement 'getSession'
+-- and 'setSession'.
 --
+-- By default, the secret session key is taken from the
+-- environment variable \"SESSION_KEY\", or a default dummy key is used if the
+-- environment variable \"ENV\" is set to \"development\". You can override
+-- this behaviour by implementing the 'sessionKey' method.
+--
+-- The default generated cookie always uses the `httponly` option, and the
+-- `secure` option if the request is over HTTPS. You can override this behavior,
+-- as well as other cookie options (e.g. the path, expiration and domain) by
+-- implementing the `sessionBaseCookie` method.
+--
+-- If the controller
+-- state contains a dedicated field of type 'Maybe Session', a reasonable
+-- implementation would be:
+--
 -- > data MyAppSettings = MyAppSettings { myAppSess :: Maybe Session, ...}
 -- >
 -- > instance HasSession MyAppSettings where
@@ -79,7 +90,7 @@
           _ -> (error "SESSION_KEY environment variable not set")
 
   -- | Returns the cached session for the current request, or nothing if the
-  -- session has not been set yet for this request. 
+  -- session has not been set yet for this request.
   getSession :: hs -> Maybe Session
 
   -- | Stores a parsed or changed session for the remainder of the request.This
@@ -87,6 +98,14 @@
   -- to the \"Set-Cookie\" header when responding.
   setSession :: Session -> Controller hs ()
 
+  sessionBaseCookie :: Controller hs SetCookie
+  sessionBaseCookie = defaultSessionBaseCookie
+
+defaultSessionBaseCookie :: Controller hs SetCookie
+defaultSessionBaseCookie = do
+  req <- request
+  return $ def { setCookieSecure = appearsSecure req, setCookieHttpOnly = True }
+
 -- | A trivial implementation if the 'Controller' settings is just a Session
 -- store.
 instance HasSession (Maybe Session) where
@@ -100,6 +119,7 @@
             => Controller hs a -> Controller hs a
 withSession (ControllerT act) = do
   sk <- sessionKey
+  baseCookie <- sessionBaseCookie
   ControllerT $ \st0 req -> do
     (eres, st) <- act st0 req
     case eres of
@@ -107,6 +127,7 @@
         let resp = case getSession st of
                      Just sess -> addCookie
                                    ("session", dumpSession sk sess)
+                                   baseCookie
                                    resp0
                      Nothing -> resp0
         return (Left resp, st)
@@ -115,18 +136,22 @@
 -- | Adds a \"Set-Cookie\" with the given key-value tuple to the 'Response'.
 -- The path set on the cookie is \"/\", meaning it applies to all routes on the
 -- domain, and no expiration is set.
-addCookie :: (S.ByteString, S.ByteString) -> Response -> Response
-addCookie (key, value) (ResponseFile stat hdrs fl mfp) =
-  ResponseFile stat (("Set-Cookie", cookie key value):hdrs) fl mfp
-addCookie (key, value) (ResponseBuilder stat hdrs bldr) =
-  ResponseBuilder stat (("Set-Cookie", cookie key value):hdrs) bldr
-addCookie (key, value) (ResponseStream stat hdrs src) =
-  ResponseStream stat (("Set-Cookie", cookie key value):hdrs) src
-addCookie _ resp = resp -- Can't do anything for ResponseRaw
+addCookie :: (S.ByteString, S.ByteString) -> SetCookie -> Response -> Response
 
-cookie :: S.ByteString -> S.ByteString -> S.ByteString
-cookie key value = toByteString . renderSetCookie $
-    def { setCookieName = key
+addCookie (key, value) baseCookie (ResponseFile stat hdrs fl mfp) =
+  ResponseFile stat (("Set-Cookie", cookie baseCookie key value):hdrs) fl mfp
+
+addCookie (key, value) baseCookie (ResponseBuilder stat hdrs bldr) =
+  ResponseBuilder stat (("Set-Cookie", cookie baseCookie key value):hdrs) bldr
+
+addCookie (key, value) baseCookie (ResponseStream stat hdrs src) =
+  ResponseStream stat (("Set-Cookie", cookie baseCookie key value):hdrs) src
+
+addCookie _ _ resp = resp -- Can't do anything for ResponseRaw
+
+cookie :: SetCookie -> S.ByteString -> S.ByteString -> S.ByteString
+cookie baseCookie key value = toByteString . renderSetCookie $
+    baseCookie { setCookieName = key
         , setCookieValue = value
         , setCookiePath = Just "/" }