#
# You should set gzip to true if you are running phoenix.digest
# when deploying your static files in production.
- plug(Plug.Static, at: "/media", from: "uploads", gzip: false)
+ plug(CORSPlug)
+ plug(Pleroma.Plugs.HTTPSecurityPlug)
+
+ plug(Plug.Static, at: "/media", from: Pleroma.Uploaders.Local.upload_path(), gzip: false)
plug(
Plug.Static,
at: "/",
from: :pleroma,
- only: ~w(index.html static finmoji emoji packs sounds images instance sw.js)
+ only:
+ ~w(index.html static finmoji emoji packs sounds images instance sw.js favicon.png schemas)
)
# Code reloading can be explicitly enabled under the
parsers: [:urlencoded, :multipart, :json],
pass: ["*/*"],
json_decoder: Jason,
- length: Application.get_env(:pleroma, :instance) |> Keyword.get(:upload_limit)
+ length: Application.get_env(:pleroma, :instance) |> Keyword.get(:upload_limit),
+ body_reader: {Pleroma.Web.Plugs.DigestPlug, :read_body, []}
)
plug(Plug.MethodOverride)
plug(Plug.Head)
+ cookie_name =
+ if Application.get_env(:pleroma, Pleroma.Web.Endpoint) |> Keyword.get(:secure_cookie_flag),
+ do: "__Host-pleroma_key",
+ else: "pleroma_key"
+
# The session will be stored in the cookie and signed,
# this means its contents can be read but not tampered with.
# Set :encryption_salt if you would also like to encrypt it.
plug(
Plug.Session,
store: :cookie,
- key: "_pleroma_key",
- signing_salt: "CqaoopA2"
+ key: cookie_name,
+ signing_salt: "CqaoopA2",
+ http_only: true,
+ secure:
+ Application.get_env(:pleroma, Pleroma.Web.Endpoint) |> Keyword.get(:secure_cookie_flag),
+ extra: "SameSite=Strict"
)
plug(Pleroma.Web.Router)