]> cat aescling's git repositories - mastodon.git/commit
cat aescling's git repositories / mastodon.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 7607f47) | patch
feat(cookies): Use the same-site attribute to lax (#8626)
authorSorin Davidoi <sorin.davidoi@protonmail.com>
Sat, 8 Sep 2018 21:54:28 +0000 (23:54 +0200)
committerEugen Rochko <eugen@zeonfederated.com>
Sat, 8 Sep 2018 21:54:28 +0000 (23:54 +0200)
commit6f3d934bc1c11e7c316e5956c59d4e37541c8737
tree6f7b58d4a9cd02726d6854503bcca79c6c588692tree | snapshot
parent7607f4778b0e9021d4ed6ebcafbff60e67e38e59commit | diff
feat(cookies): Use the same-site attribute to lax (#8626)

CSFR-prevention is already implemented but adding this doesn't hurt.

A brief introduction to Same-Site cookies (and the difference between strict and
lax) can be found at
https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/

TLDR: We use lax since we want the cookies to be sent when the user navigates
safely from an external site.
config/initializers/devise.rb diff | blob | history
config/initializers/session_store.rb diff | blob | history
spec/rails_helper.rb diff | blob | history
source code fur Kibicat Mastodon