Merge pull request #68 from YaleSTC/65_security

CSRF protection and SSL-only
YaleSTC · Nov 17, 2014 · 0306c7e · 0306c7e
2 parents 19448ea + d413ab3
commit 0306c7e
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
@@ -1,4 +1,5 @@
 class ApplicationController < ActionController::Base
+ protect_from_forgery
 
  before_action CASClient::Frameworks::Rails::Filter
  before_action :current_user

diff --git a/config/application.rb b/config/application.rb
@@ -24,5 +24,8 @@ class Application < Rails::Application
 
  # Autoload lib/ folder including all subdirectories
  config.autoload_paths += Dir["#{config.root}/lib", "#{config.root}/lib/**/"]
+
+ # Use SSL for everything, including cookies
+ config.force_ssl = true
  end
 end