Merge pull request #478 from BetterErrors/fix/csrf-token-cookie-path

Fix path of CSRF Token cookie
BetterErrors · Sep 24, 2020 · eae8285 · eae8285
2 parents a9d1c4b + da0e0d9
commit eae8285
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/lib/better_errors/middleware.rb b/lib/better_errors/middleware.rb
@@ -40,7 +40,7 @@ def self.allow_ip!(addr)
     allow_ip! "127.0.0.0/8"
     allow_ip! "::1/128" rescue nil # windows ruby doesn't have ipv6 support
 
-    CSRF_TOKEN_COOKIE_NAME = 'BetterErrors-CSRF-Token'
+    CSRF_TOKEN_COOKIE_NAME = "BetterErrors-#{VERSION}-CSRF-Token"
 
     # A new instance of BetterErrors::Middleware
     #
@@ -113,7 +113,7 @@ def show_error_page(env, exception=nil)
       response = Rack::Response.new(content, status_code, { "Content-Type" => "text/#{type}; charset=utf-8" })
 
       unless request.cookies[CSRF_TOKEN_COOKIE_NAME]
-        response.set_cookie(CSRF_TOKEN_COOKIE_NAME, value: csrf_token, httponly: true, same_site: :strict)
+        response.set_cookie(CSRF_TOKEN_COOKIE_NAME, value: csrf_token, path: "/", httponly: true, same_site: :strict)
       end
 
       # In older versions of Rack, the body returned here is actually a Rack::BodyProxy which seems to be a bug.