htwkmooc/codeocean
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use SameSite=Lax for LTI login

Browse Source
This commit is contained in:
Sebastian Serth
2022-09-06 13:28:12 +02:00
parent fe0ad7a79d
commit 2028e636a3
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
config/initializers/session_store.rb
View File

@ -18,4 +18,7 @@ Rails.application.config.session_store :cookie_store,
expire_after: 1.month, expire_after: 1.month,
secure: Rails.env.production? || Rails.env.staging?, secure: Rails.env.production? || Rails.env.staging?,
path: Rails.application.config.relative_url_root, path: Rails.application.config.relative_url_root,
same_site: :strict # Signing in through LTI won't work with `SameSite=Strict`
# as the cookie is not sent when accessing the `implement` route
# following the LTI launch initiated by the LMS as a third party.
same_site: :lax