Browse Source

Make cookies https-only if LOCAL_HTTPS is true, set X-Frame-Options to DENY,

add permissive CORS to API controllers
pull/4/head
Eugen Rochko 6 years ago
parent
commit
9467b900a2
3 changed files with 13 additions and 1 deletions
  1. +8
    -0
      app/controllers/api_controller.rb
  2. +4
    -0
      config/application.rb
  3. +1
    -1
      config/initializers/session_store.rb

+ 8
- 0
app/controllers/api_controller.rb View File

@ -4,6 +4,7 @@ class ApiController < ApplicationController
skip_before_action :verify_authenticity_token
before_action :set_rate_limit_headers
before_action :set_cors_headers
rescue_from ActiveRecord::RecordInvalid do |e|
render json: { error: e.to_s }, status: 422
@ -46,6 +47,13 @@ class ApiController < ApplicationController
response.headers['X-RateLimit-Reset'] = (now + (match_data[:period] - now.to_i % match_data[:period])).to_s
end
def set_cors_headers
response.headers['Access-Control-Allow-Origin'] = '*'
response.headers['Access-Control-Allow-Methods'] = 'POST, PUT, DELETE, GET, OPTIONS'
response.headers['Access-Control-Request-Method'] = '*'
response.headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization'
end
def current_resource_owner
User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token
end

+ 4
- 0
config/application.rb View File

@ -36,5 +36,9 @@ module Mastodon
config.to_prepare do
Doorkeeper::AuthorizationsController.layout 'auth'
end
config.action_dispatch.default_headers = {
'X-Frame-Options' => 'DENY'
}
end
end

+ 1
- 1
config/initializers/session_store.rb View File

@ -1,3 +1,3 @@
# Be sure to restart your server when you modify this file.
Rails.application.config.session_store :cookie_store, key: '_mastodon_session'
Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (ENV['LOCAL_HTTPS'] == 'true')

Loading…
Cancel
Save