maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Attempt to turn off Flipper UI CSRF protections (#9360) [deploy]

Browse source 
* Turn off flipper ui CSRF

* Turn off CSRF protection in Flipper UI
This commit is contained in:
Josh Puetz 2020-07-16 21:56:11 -05:00 • committed by GitHub
parent a6c4f0b884
commit 73a3bcc68a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
config/routes.rb
View file

@ -44,13 +44,9 @@ Rails.application.routes.draw do
authenticate :user, ->(user) { user.has_role?(:tech_admin) } do
mount Blazer::Engine, at: "blazer"
flipper_ui = Flipper::UI.app(Flipper) do |builder|
builder.use Rack::Protection, origin_whitelist: [URL.url]
# Requires redis-store > 1.9: https://github.com/redis-store/redis-store/pull/333
builder.use Rack::Session::Cookie,
secret: Rails.application.secrets[:secret_key_base]
builder.use Rack::CommonLogger, STDOUT
end
flipper_ui = Flipper::UI.app(Flipper,
{ rack_protection: { except: %i[authenticity_token form_token json_csrf
remote_token http_origin session_hijacking] } })
mount flipper_ui, at: "feature_flags"
end