Phase 3: WebSocket CSRF, SameSite=Lax, Tenant FK CASCADE

2026-08-04 09:27:10 +02:00
parent 4a104af615
commit e7edc46286
3 changed files with 145 additions and 3 deletions
@@ -39,7 +39,7 @@ class Settings(BaseSettings):
    bcrypt_rounds: int = 12
    session_cookie_name: str = "leocrm_session"
    session_cookie_secure: bool = True  # Secure by default — set to False only for local HTTP development
-    session_cookie_samesite: str = "strict"  # Strict blocks WebSocket cookies; use Lax only if WS needed
+    session_cookie_samesite: str = "lax"  # Lax allows WebSocket cookies while preventing CSRF on top-level navigations
    session_cookie_httponly: bool = True
    password_reset_expiry_hours: int = 1