Fix cookies secure flag being set when served over Tor (#17992)

2022-04-08 12:47:18 +02:00
parent 46633f1de1
commit 6e418bf346
4 changed files with 2 additions and 30 deletions
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -2,5 +2,5 @@

 Rails.application.config.session_store :cookie_store,
  key: '_mastodon_session',
-  secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true'),
+  secure: false, # All cookies have their secure flag set by the force_ssl option in production
  same_site: :lax