Disable Same-Site cookie implementation to fix SSO issues on WebKit b…

…rowsers (#9819)
mastodon · Jan 15, 2019 · ecf40d0 · ecf40d0
1 parent a12f6d1
commit ecf40d0
Show file tree

Hide file tree

Showing 3 changed files with 1 addition and 4 deletions.
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
@@ -10,7 +10,6 @@
     expires: 1.year.from_now,
     httponly: true,
     secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true'),
-    same_site: :lax,
   }
 end
 
@@ -21,7 +20,6 @@
       expires: 1.year.from_now,
       httponly: true,
       secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true'),
-      same_site: :lax,
     }
   else
     warden.logout

diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb
@@ -1,3 +1,3 @@
 # Be sure to restart your server when you modify this file.
 
-Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true'), same_site: :lax
+Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (Rails.env.production? || ENV['LOCAL_HTTPS'] == 'true')
diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb
@@ -29,7 +29,6 @@ def sign_in(resource, _deprecated = nil, scope: nil)
       value: resource.activate_session(warden.request),
       expires: 1.year.from_now,
       httponly: true,
-      same_site: :lax,
     }
   end
 end