From 84abb70f17d4e6087387f364d2c14503395054af Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Mon, 17 May 2021 18:39:22 +0100 Subject: [PATCH] Default rails generated cookies to SameSite=Lax --- config/initializers/new_framework_defaults_6_1.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/new_framework_defaults_6_1.rb b/config/initializers/new_framework_defaults_6_1.rb index dd27b5e20..f80d838e7 100644 --- a/config/initializers/new_framework_defaults_6_1.rb +++ b/config/initializers/new_framework_defaults_6_1.rb @@ -23,7 +23,7 @@ Rails.application.config.active_job.skip_after_callbacks_if_terminated = true # # This change is not backwards compatible with earlier Rails versions. # It's best enabled when your entire app is migrated and stable on 6.1. -# Rails.application.config.action_dispatch.cookies_same_site_protection = :lax +Rails.application.config.action_dispatch.cookies_same_site_protection = :lax # Generate CSRF tokens that are encoded in URL-safe Base64. # -- 2.45.1