about summary refs log tree commit diff
path: root/config/initializers/session_store.rb
AgeCommit message (Collapse)Author
2021-02-11Drop dependency on secure_headers, fix response headers (#15712)Claire
* Drop dependency on secure_headers, use always_write_cookie instead * Fix cookies in Tor Hidden Services by moving configuration to application.rb * Instead of setting always_write_cookie at boot, monkey-patch ActionDispatch
2021-02-11Onion service related changes to HTTPS handling (#15560)Cecylia Bocovich
* Enable secure cookie flag for https only * Disable force_ssl for .onion hosts only Co-authored-by: Aiden McClelland <me@drbonez.dev>
2020-11-06Fix cookies not having a SameSite attribute (#15098)Eugen Rochko
2019-01-15Disable Same-Site cookie implementation to fix SSO issues on WebKit browsers ↵Moritz Heiber
(#9819)
2018-09-08feat(cookies): Use the same-site attribute to lax (#8626)Sorin Davidoi
CSFR-prevention is already implemented but adding this doesn't hurt. A brief introduction to Same-Site cookies (and the difference between strict and lax) can be found at https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/ TLDR: We use lax since we want the cookies to be sent when the user navigates safely from an external site.
2018-01-05Fix enforce HTTPS in production. (#6180)Naoki Kosaka
2016-11-02Make cookies https-only if LOCAL_HTTPS is true, set X-Frame-Options to DENY,Eugen Rochko
add permissive CORS to API controllers
2016-02-20Initial commitEugen Rochko
generated by cgit-pink (git 2.37.1) at 2024-12-02 00:22:54 +0000