proxy-in-anger
a (hacky, wip) multi-tenant oidc-terminating reverse proxy, written in anger on top of pingora
Star
Fork
Watch

set same-site=lax on the session cookie explicitly main

this should avoid some csrf issues (lax because we want the cookie still sent when users click on links from elsewhere) but helps mitigate csrf on sessions. per https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie, this is also the default value in chromium-based browsers anyway. Closes MM-5

Author directxman12.dev Date Commit Parent f6c28337 Change ID
+1
1 changed file
Unified Split
+1
1 changed file