From 1da2381379da4d305a9ab7ae9758aad2c84ccacf Mon Sep 17 00:00:00 2001 From: Zsolt Tasnadi Date: Tue, 5 May 2026 20:04:24 +0200 Subject: [PATCH] session fix 2 --- apps/api/config/application.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/apps/api/config/application.rb b/apps/api/config/application.rb index 0eee024..b3799d4 100644 --- a/apps/api/config/application.rb +++ b/apps/api/config/application.rb @@ -22,11 +22,9 @@ module Api config.hosts << ENV["WEBAPP_TECHNICAL_DOMAIN"] if ENV["WEBAPP_TECHNICAL_DOMAIN"].present? config.hosts << "teletypegames.org" - # Trust Traefik and other Docker-internal proxies so Rails correctly reads - # X-Forwarded-Proto: https — required for CSRF origin check behind SSL termination - config.action_dispatch.trusted_proxies = - ActionDispatch::RemoteIp::TRUSTED_PROXIES + - [IPAddr.new("172.16.0.0/12"), IPAddr.new("10.0.0.0/8"), IPAddr.new("192.168.0.0/16")] + # Traefik terminates SSL so Rails sees HTTP internally; disable the origin + # header check (CSRF token itself is still validated) + config.action_dispatch.forgery_protection_origin_check = false config.autoload_lib(ignore: %w[assets tasks]) end