mastodon/config/initializers/session_store.rb

# Be sure to restart your server when you modify this file.

Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (ENV['LOCAL_HTTPS'] == 'true')
Initial commit 2016-02-20 21:53:20 +00:00			`# Be sure to restart your server when you modify this file.`

Make cookies https-only if LOCAL_HTTPS is true, set X-Frame-Options to DENY, add permissive CORS to API controllers 2016-11-02 11:57:14 +00:00			`Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (ENV['LOCAL_HTTPS'] == 'true')`