Delegate HSTS to nginx.
Remove the ssl_options config option. Let nginx handle HSTS and http->https redirects instead. At the rails level, all we need to do is set the secure cookie flag when https is enabled (which we assume it's enabled in production).
This commit is contained in:
@@ -46,17 +46,6 @@ module Danbooru
|
||||
|
||||
config.log_tags = [->(req) {"PID:#{Process.pid}"}]
|
||||
config.action_controller.action_on_unpermitted_parameters = :raise
|
||||
config.force_ssl = true
|
||||
|
||||
if Rails.env.production? && Danbooru.config.ssl_options.present?
|
||||
config.ssl_options = Danbooru.config.ssl_options
|
||||
else
|
||||
config.ssl_options = {
|
||||
hsts: false,
|
||||
secure_cookies: false,
|
||||
redirect: { exclude: ->(request) { true } }
|
||||
}
|
||||
end
|
||||
|
||||
if File.exist?("#{config.root}/REVISION")
|
||||
config.x.git_hash = File.read("#{config.root}/REVISION").strip
|
||||
|
||||
Reference in New Issue
Block a user