chore: cookies with "secure" flag (only transmitted through https)

2024-07-03 11:04:16 +02:00 · 2024-07-03 11:04:16 +02:00 · 1eb0bdb4ae
commit 1eb0bdb4ae
parent b3ccfc16c4
6 changed files with 10 additions and 7 deletions
--- a/app/controllers/application_controller/long_lived_authenticity_token.rb
+++ b/app/controllers/application_controller/long_lived_authenticity_token.rb
@ -24,7 +24,8 @@ module ApplicationController::LongLivedAuthenticityToken
    cookies.signed[COOKIE_NAME] = {
      value: csrf_token,
      expires: 1.year.from_now,
-      httponly: true
+      httponly: true,
+      secure: Rails.env.production?
    }
    session[:_csrf_token] = csrf_token