mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-04-23 00:46:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

cookies: Use SameSite=None if in an iframe from another site

Browse source
This commit is contained in:
Richard Hansen 2020-10-02 23:53:05 -04:00 • committed by John McLear
parent bf53162cdd
commit 2db4b04af3
5 changed files with 71 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/node/utils/Settings.js
View file

@ -268,6 +268,24 @@ exports.sessionKey = false;
*/
exports.trustProxy = false;
/*
* Settings controlling the session cookie issued by Etherpad.
*/
exports.cookie = {
/*
* Value of the SameSite cookie property. "Lax" is recommended unless
* Etherpad will be embedded in an iframe from another site, in which case
* this must be set to "None". Note: "None" will not work (the browser will
* not send the cookie to Etherpad) unless https is used to access Etherpad
* (either directly or via a reverse proxy with "trustProxy" set to true).
*
* "Strict" is not recommended because it has few security benefits but
* significant usability drawbacks vs. "Lax". See
* https://stackoverflow.com/q/41841880 for discussion.
*/
sameSite: 'Lax',
};
/*
* This setting is used if you need authentication and/or
* authorization. Note: /admin always requires authentication, and