682278ed75
* Mess with ssl * Add redirect false * Remove redirect config * Redirect back to false * Mess with validrequest * Add validrequest back in * Secure sessions * Add domain to session_store * Fiddle with ssl options * Fiddle with secure * Same site lax * Remove force_ssl * Remove domain from session_store * Add domain back * Secure session cookie * Set secure with var * Revert default_url_options change * Set session store to secure * revert secure force * Revert unintended change * The cookie domain property should not be set on localhost * Switch to no domain unless in production Co-authored-by: rhymes <rhymes@hey.com>
23 lines
1.3 KiB
Ruby
23 lines
1.3 KiB
Ruby
# Be sure to restart your server when you modify this file.
|
|
|
|
# we want a default in case the expiration is not set or set to 0
|
|
# because 0 is an invalid value
|
|
app_config_expires_after = ApplicationConfig["SESSION_EXPIRY_SECONDS"].to_i
|
|
expires_after = app_config_expires_after.positive? ? app_config_expires_after : 2.weeks.to_i
|
|
|
|
# see <https://github.com/redis-store/redis-rails#session-storage> for configuration options,
|
|
# httponly has been added in <https://github.com/redis-store/redis-actionpack/pull/17>
|
|
servers = ApplicationConfig["REDIS_SESSIONS_URL"] || ApplicationConfig["REDIS_URL"]
|
|
|
|
# domain property should only be set in production
|
|
domain = Rails.env.production? ? ApplicationConfig["APP_DOMAIN"] : nil
|
|
|
|
Rails.application.config.session_store :redis_store,
|
|
key: ApplicationConfig["SESSION_KEY"],
|
|
domain: domain,
|
|
servers: servers,
|
|
expire_after: expires_after,
|
|
signed: true,
|
|
secure: ApplicationConfig["FORCE_SSL_IN_RAILS"] == "true",
|
|
same_site: :lax,
|
|
httponly: true
|