moby/brewlog
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: switch to lax site policy for cookies

Browse source
This commit is contained in:
Jon Seager 2025-11-25 19:15:29 +00:00
parent 7d4c7dda28
commit d41cf7a86c
No known key found for this signature in database
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/server/routes/auth.rs
View file

@ -90,7 +90,7 @@ pub(crate) async fn login_submit(
let mut cookie = Cookie::new(SESSION_COOKIE_NAME, session_token); let mut cookie = Cookie::new(SESSION_COOKIE_NAME, session_token);
cookie.set_path("/"); cookie.set_path("/");
cookie.set_http_only(true); cookie.set_http_only(true);
cookie.set_same_site(tower_cookies::cookie::SameSite::Strict); cookie.set_same_site(tower_cookies::cookie::SameSite::Lax);
// Enable secure flag if BREWLOG_SECURE_COOKIES is set to "true" // Enable secure flag if BREWLOG_SECURE_COOKIES is set to "true"
// This should be enabled in production when serving over HTTPS // This should be enabled in production when serving over HTTPS