Fix cookies not having a SameSite attribute (#15098)

2020-11-06 11:57:14 +01:00
parent 9b1f2a4b61
commit acc1c03861
3 changed files with 9 additions and 1 deletions
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@ -10,6 +10,7 @@ Warden::Manager.after_set_user except: :fetch do |user, warden|
    expires: 1.year.from_now,
    httponly: true,
    secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true'),
+    same_site: :lax,
  }
 end

@ -20,6 +21,7 @@ Warden::Manager.after_fetch do |user, warden|
      expires: 1.year.from_now,
      httponly: true,
      secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true'),
+      same_site: :lax,
    }
  else
    warden.logout