diff options
| author | Claire <claire.github-309c@sitedethib.com> | 2023-01-10 14:33:40 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-01-10 14:33:40 +0100 |
| commit | cff7d967f97b5119f9cf68f84973a8e36ec9d7c6 (patch) | |
| tree | c01166fbe20493170e6a207d1fdd04c1b560e9d4 | |
| parent | aefefc74c468ffd90e3ac97bfed5973717138759 (diff) | |
Fix CSRF protection (#23037)
Fix regression from #23014
| -rw-r--r-- | config/environments/production.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/config/environments/production.rb b/config/environments/production.rb index abb46bd16..99c9bb40c 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -138,7 +138,7 @@ Rails.application.configure do 'X-Content-Type-Options' => 'nosniff', 'X-XSS-Protection' => '0', 'Permissions-Policy' => 'interest-cohort=()', - 'Referrer-Policy' => 'no-referrer', + 'Referrer-Policy' => 'same-origin', } config.x.otp_secret = ENV.fetch('OTP_SECRET') |