Beissea 85 pen test fixes #248
Conversation
|
Just realised: PLEASE DON'T ACTUALLY MERGE THIS! |
|
Just to note, while this should technically work, The way it's set up on the new platform means we're always in a dev environment. So I think we should sort out BEISSEA-86 before we merge this. I'll ask Jeni if I can prioritise that after doing the data capture ticket |
Ha, I was just going to write an identical comment. Sounds good to me. |
xonde
force-pushed
the
BEISSEA-85-pen-test-fixes
branch
from
b836cd3 to
05ad816
Compare
SeaPublicWebsite/Startup.cs
Outdated
| private void ConfigureAntiForgeryCookieOptions(AntiforgeryOptions options) | ||
| { | ||
| options.Cookie.Name = "Antiforgery"; | ||
| options.Cookie.SecurePolicy = webHostEnvironment.IsDevelopment() ? CookieSecurePolicy.None : CookieSecurePolicy.Always; | ||
| } | ||
|
|
There was a problem hiding this comment.
Turns out HER has this exact change and it's breaking the health check since the health check is apparently over HTTP, not HTTPS. We'll need to add in an exception to the health check endpoint that it doesn't use an anti forgery cookie.
There was a problem hiding this comment.
Sounds good, thanks for checking
This commit contains WIP code that should probably be removed. I have made a note on each section with a "TODO: BEISSEA-85"
No description provided.