8ab0ca7d64
Merge pull request from GHSA-c2r5-cfqr-c553
...
* Add hardening monkey-patch to prevent IP spoofing on misconfigured installations
* Remove rack-attack safelist
2 years ago
3fa0dd0b88
Merge pull request from GHSA-c2r5-cfqr-c553
...
* Add hardening monkey-patch to prevent IP spoofing on misconfigured installations
* Remove rack-attack safelist
2 years ago
6e418bf346
Fix cookies secure flag being set when served over Tor ( #17992 )
4 years ago
c9e8e1739c
replace all instances of "ends_with?" with "end_with?" ( #15745 )
...
The "ends_with?" method is just a Rails alias of Ruby's "end_with?" method.
Using the latter makes the code less brittle.
5 years ago
3f8523130d
use host instead of headers to make Rack happy ( #15741 )
...
"headers" is provided by Rails, Rack can't rely on it
5 years ago
3447bd2f80
Monkey patch Rack::Session to send secure cookies to onions ( #15725 )
5 years ago
21fb3f3684
Drop dependency on secure_headers, fix response headers ( #15712 )
...
* Drop dependency on secure_headers, use always_write_cookie instead
* Fix cookies in Tor Hidden Services by moving configuration to application.rb
* Instead of setting always_write_cookie at boot, monkey-patch ActionDispatch
5 years ago
Claire
Eugen Rochko
Justin Tracey
Cecylia Bocovich