From 9467b900a27fd646952cbf37f7542765881dceac Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Wed, 2 Nov 2016 12:57:14 +0100
Subject: Make cookies https-only if LOCAL_HTTPS is true, set X-Frame-Options
 to DENY, add permissive CORS to API controllers

---
 config/initializers/session_store.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'config/initializers')

diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
index 85983d259..ef61543a8 100644
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -1,3 +1,3 @@
 # Be sure to restart your server when you modify this file.
 
-Rails.application.config.session_store :cookie_store, key: '_mastodon_session'
+Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (ENV['LOCAL_HTTPS'] == 'true')
-- 
cgit