feat(csrf_protection): use cookiePath from config

2025-02-10 08:48:40 +07:00 · 2025-02-10 08:48:40 +07:00 · b6d73df92e
parent a600568ab8
commit b6d73df92e
1 changed files with 2 additions and 1 deletions
--- a/src/routes/csrf_protection.ts
+++ b/src/routes/csrf_protection.ts
@ -1,11 +1,12 @@
 import { doubleCsrf } from "csrf-csrf";
 import sessionSecret from "../services/session_secret.js";
 import { isElectron } from "../services/utils.js";
+import config from "../services/config.js";

 const doubleCsrfUtilities = doubleCsrf({
    getSecret: () => sessionSecret,
    cookieOptions: {
-        path: "", // empty, so cookie is valid only for the current path
+        path: config.Cookies.cookiePath,
        secure: false,
        sameSite: "strict",
        httpOnly: !isElectron // set to false for Electron, see https://github.com/TriliumNext/Notes/pull/966