From 7b6cead6d5a73234f28a8593765ca993c79ca8e4 Mon Sep 17 00:00:00 2001 From: Zsolt Tasnadi Date: Tue, 5 May 2026 20:02:39 +0200 Subject: [PATCH] session fix --- apps/api/app/controllers/application_controller.rb | 2 +- apps/api/config/application.rb | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/apps/api/app/controllers/application_controller.rb b/apps/api/app/controllers/application_controller.rb index 0491b0a..1c07694 100644 --- a/apps/api/app/controllers/application_controller.rb +++ b/apps/api/app/controllers/application_controller.rb @@ -1,3 +1,3 @@ class ApplicationController < ActionController::Base - protect_from_forgery with: :null_session + protect_from_forgery with: :exception end diff --git a/apps/api/config/application.rb b/apps/api/config/application.rb index 46313da..0eee024 100644 --- a/apps/api/config/application.rb +++ b/apps/api/config/application.rb @@ -22,6 +22,12 @@ module Api config.hosts << ENV["WEBAPP_TECHNICAL_DOMAIN"] if ENV["WEBAPP_TECHNICAL_DOMAIN"].present? config.hosts << "teletypegames.org" + # Trust Traefik and other Docker-internal proxies so Rails correctly reads + # X-Forwarded-Proto: https — required for CSRF origin check behind SSL termination + config.action_dispatch.trusted_proxies = + ActionDispatch::RemoteIp::TRUSTED_PROXIES + + [IPAddr.new("172.16.0.0/12"), IPAddr.new("10.0.0.0/8"), IPAddr.new("192.168.0.0/16")] + config.autoload_lib(ignore: %w[assets tasks]) end end