about summary refs log tree commit diff
path: root/config/initializers
diff options
context:
space:
mode:
authorEugen Rochko <eugen@zeonfederated.com>2016-11-02 12:57:14 +0100
committerEugen Rochko <eugen@zeonfederated.com>2016-11-02 12:58:15 +0100
commit9467b900a27fd646952cbf37f7542765881dceac (patch)
treec124c4ffb50190d7e876d354f3e1ded8ca650d51 /config/initializers
parent0a6b5e2c17be11c431d5b5b3d188db7e5021d914 (diff)
Make cookies https-only if LOCAL_HTTPS is true, set X-Frame-Options to DENY,
add permissive CORS to API controllers
Diffstat (limited to 'config/initializers')
-rw-r--r--config/initializers/session_store.rb2
1 files changed, 1 insertions, 1 deletions
diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
index 85983d259..ef61543a8 100644
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -1,3 +1,3 @@
 # Be sure to restart your server when you modify this file.
 
-Rails.application.config.session_store :cookie_store, key: '_mastodon_session'
+Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (ENV['LOCAL_HTTPS'] == 'true')