95d6aecb51
## Summary - Adds `httponly` and `secure` flags to session cookie configuration - Adds RSpec tests for session configuration ## Changes - `config/initializers/session_store.rb`: add `httponly: true`, `secure: FORCE_SSL` - `spec/config/session_store_spec.rb`: tests for all session store options Ref #2683 (hardens the session cookie but does not remove it, sessions are still needed for super_admin dashboard) --------- Co-authored-by: Adam-Relay <adam@userelay.ai> Co-authored-by: Adam Berger <adam@adam-berger.com> Co-authored-by: Vishnu Narayanan <iamwishnu@gmail.com>
11 lines
525 B
Ruby
11 lines
525 B
Ruby
# Be sure to restart your server when you modify this file.
|
|
# Sessions are used only for the super_admin dashboard (flash/CSRF), not for API auth.
|
|
|
|
secure_cookies = ActiveModel::Type::Boolean.new.cast(ENV.fetch('FORCE_SSL', false))
|
|
|
|
Rails.application.config.session_store :cookie_store,
|
|
key: '_chatwoot_session',
|
|
same_site: :lax,
|
|
secure: secure_cookies,
|
|
httponly: true
|