diff options
| author | kaniini <nenolod@gmail.com> | 2019-04-16 18:40:56 +0000 |
|---|---|---|
| committer | kaniini <nenolod@gmail.com> | 2019-04-16 18:40:56 +0000 |
| commit | 02a53d00c93969ff99a460f69e92be5af2628691 (patch) | |
| tree | 756aa6d47ad551f5f5c8cbb0744c0517230948dd /docs/config.md | |
| parent | cde7711b12d64081f16e88a3f3ac93c811471d61 (diff) | |
| parent | 2472efb4e9aafe68d1ab3eef12ea3c3ad3859029 (diff) | |
| download | pleroma-02a53d00c93969ff99a460f69e92be5af2628691.tar.gz | |
Merge branch 'fix/remote-follow-auth' into 'develop'
Fix: remote follows should not ask user to log-in again for authorization
See merge request pleroma/pleroma!1060
Diffstat (limited to 'docs/config.md')
| -rw-r--r-- | docs/config.md | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/docs/config.md b/docs/config.md index e286104df..117fda960 100644 --- a/docs/config.md +++ b/docs/config.md @@ -221,6 +221,8 @@ This section is used to configure Pleroma-FE, unless ``:managed_config`` in ``:i - `scheme` - e.g `http`, `https` - `port` - `path` +* `extra_cookie_attrs` - a list of `Key=Value` strings to be added as non-standard cookie attributes. Defaults to `["SameSite=Lax"]`. See the [SameSite article](https://www.owasp.org/index.php/SameSite) on OWASP for more info. + **Important note**: if you modify anything inside these lists, default `config.exs` values will be overwritten, which may result in breakage, to make sure this does not happen please copy the default value for the list from `config.exs` and modify/add only what you need @@ -442,6 +444,8 @@ The server should also be started with `OAUTH_CONSUMER_STRATEGIES="..." mix phx. Note: each strategy requires separate setup (on external provider side and Pleroma side). Below are the guidelines on setting up most popular strategies. +Note: make sure that `"SameSite=Lax"` is set in `extra_cookie_attrs` when you have this feature enabled. OAuth consumer mode will not work with `"SameSite=Strict"` + * For Twitter, [register an app](https://developer.twitter.com/en/apps), configure callback URL to https://<your_host>/oauth/twitter/callback * For Facebook, [register an app](https://developers.facebook.com/apps), configure callback URL to https://<your_host>/oauth/facebook/callback, enable Facebook Login service at https://developers.facebook.com/apps/<app_id>/fb-login/settings/ |