Commits on Jan 8, 2024

1. Remove redundant custom SameSiteSecurity::Middleware …

   This was introduced in this PR [1] in order to set `SameSite=lax` on all
   cookies. However, in the current version of Rails (v7.0.8) this is now
   configurable via `config.action_dispatch.cookies_same_site_protection` [2]
   and it defaults to `:lax`.
   
   I've left the `CookiesSecurityTest` integration test in place even
   though it's now testing default behaviour, because (a) it's also testing
   that the `httponly: true` option is set on the cookie store; and (b) it
   provides a trail back to the original PR which explains a bit about why
   it was introduced and links to a Trello card.
   
   I've also double-checked in a browser that the session cookie still has
   "SameSite=lax" set.
   
   [1]: #507
   [2]: https://guides.rubyonrails.org/v7.0.8/configuring.html#config-action-dispatch-cookies-same-site-protection

   

   floehopper committed Jan 8, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 340a301
   • Browse repository at this point

   Copy the full SHA

   340a301 View commit details

   Browse the repository at this point in the history