From cff7d967f97b5119f9cf68f84973a8e36ec9d7c6 Mon Sep 17 00:00:00 2001
From: Claire <claire.github-309c@sitedethib.com>
Date: Tue, 10 Jan 2023 14:33:40 +0100
Subject: [PATCH] Fix CSRF protection (#23037)
Fix regression from #23014
---
config/environments/production.rb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/config/environments/production.rb b/config/environments/production.rb
index abb46bd16..99c9bb40c 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -138,7 +138,7 @@ Rails.application.configure do
'X-Content-Type-Options' => 'nosniff',
'X-XSS-Protection' => '0',
'Permissions-Policy' => 'interest-cohort=()',
- 'Referrer-Policy' => 'no-referrer',
+ 'Referrer-Policy' => 'same-origin',
}
config.x.otp_secret = ENV.fetch('OTP_SECRET')