From 9467b900a27fd646952cbf37f7542765881dceac Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Wed, 2 Nov 2016 12:57:14 +0100
Subject: [PATCH] Make cookies https-only if LOCAL_HTTPS is true, set
X-Frame-Options to DENY, add permissive CORS to API controllers
---
app/controllers/api_controller.rb | 8 ++++++++
config/application.rb | 4 ++++
config/initializers/session_store.rb | 2 +-
3 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index 0776f4ce8..273aaff85 100644
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -4,6 +4,7 @@ class ApiController < ApplicationController
skip_before_action :verify_authenticity_token
before_action :set_rate_limit_headers
+ before_action :set_cors_headers
rescue_from ActiveRecord::RecordInvalid do |e|
render json: { error: e.to_s }, status: 422
@@ -46,6 +47,13 @@ class ApiController < ApplicationController
response.headers['X-RateLimit-Reset'] = (now + (match_data[:period] - now.to_i % match_data[:period])).to_s
end
+ def set_cors_headers
+ response.headers['Access-Control-Allow-Origin'] = '*'
+ response.headers['Access-Control-Allow-Methods'] = 'POST, PUT, DELETE, GET, OPTIONS'
+ response.headers['Access-Control-Request-Method'] = '*'
+ response.headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization'
+ end
+
def current_resource_owner
User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token
end
diff --git a/config/application.rb b/config/application.rb
index d6a3aab15..92aecc8fc 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -36,5 +36,9 @@ module Mastodon
config.to_prepare do
Doorkeeper::AuthorizationsController.layout 'auth'
end
+
+ config.action_dispatch.default_headers = {
+ 'X-Frame-Options' => 'DENY'
+ }
end
end
diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
index 85983d259..ef61543a8 100644
--- a/config/initializers/session_store.rb
+++ b/config/initializers/session_store.rb
@@ -1,3 +1,3 @@
# Be sure to restart your server when you modify this file.
-Rails.application.config.session_store :cookie_store, key: '_mastodon_session'
+Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (ENV['LOCAL_HTTPS'] == 'true')