From e7035a4d39ca5b6c5741a04c0c777d5a1cc0f68f Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Wed, 2 Nov 2016 12:57:14 +0100 Subject: [PATCH] Make cookies https-only if LOCAL_HTTPS is true, set X-Frame-Options to DENY, add permissive CORS to API controllers --- app/controllers/api_controller.rb | 8 ++++++++ config/application.rb | 4 ++++ config/initializers/session_store.rb | 2 +- 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb index 0776f4ce8e..273aaff857 100644 --- a/app/controllers/api_controller.rb +++ b/app/controllers/api_controller.rb @@ -4,6 +4,7 @@ class ApiController < ApplicationController skip_before_action :verify_authenticity_token before_action :set_rate_limit_headers + before_action :set_cors_headers rescue_from ActiveRecord::RecordInvalid do |e| render json: { error: e.to_s }, status: 422 @@ -46,6 +47,13 @@ class ApiController < ApplicationController response.headers['X-RateLimit-Reset'] = (now + (match_data[:period] - now.to_i % match_data[:period])).to_s end + def set_cors_headers + response.headers['Access-Control-Allow-Origin'] = '*' + response.headers['Access-Control-Allow-Methods'] = 'POST, PUT, DELETE, GET, OPTIONS' + response.headers['Access-Control-Request-Method'] = '*' + response.headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization' + end + def current_resource_owner User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token end diff --git a/config/application.rb b/config/application.rb index d6a3aab15c..92aecc8fc1 100644 --- a/config/application.rb +++ b/config/application.rb @@ -36,5 +36,9 @@ module Mastodon config.to_prepare do Doorkeeper::AuthorizationsController.layout 'auth' end + + config.action_dispatch.default_headers = { + 'X-Frame-Options' => 'DENY' + } end end diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb index 85983d259e..ef61543a87 100644 --- a/config/initializers/session_store.rb +++ b/config/initializers/session_store.rb @@ -1,3 +1,3 @@ # Be sure to restart your server when you modify this file. -Rails.application.config.session_store :cookie_store, key: '_mastodon_session' +Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (ENV['LOCAL_HTTPS'] == 'true')