fixes #2620: Users who logged in securely should always be redirected to the HTTPS version of Danbooru

2016-07-18 16:41:38 -07:00
parent 8ea992168b
commit 122970bc11
2 changed files with 13 additions and 0 deletions
--- a/app/logical/session_creator.rb
+++ b/app/logical/session_creator.rb
@@ -28,6 +28,14 @@ class SessionCreator
        }
      end

+      if secure
+        cookies.permanent[:ssl_login] = {
+          :value => "1",
+          :secure => true,
+          :httponly => true
+        }
+      end
+
      session[:user_id] = user.id
      user.update_column(:last_ip_addr, ip_addr)
      return true