summaryrefslogtreecommitdiffstats
path: root/python/fatcat_web/web_config.py
diff options
context:
space:
mode:
Diffstat (limited to 'python/fatcat_web/web_config.py')
-rw-r--r--python/fatcat_web/web_config.py5
1 files changed, 5 insertions, 0 deletions
diff --git a/python/fatcat_web/web_config.py b/python/fatcat_web/web_config.py
index 8fe50049..8ece91f7 100644
--- a/python/fatcat_web/web_config.py
+++ b/python/fatcat_web/web_config.py
@@ -39,6 +39,11 @@ class Config(object):
IA_XAUTH_CLIENT_ID = os.environ.get("IA_XAUTH_CLIENT_ID", default=None)
IA_XAUTH_CLIENT_SECRET = os.environ.get("IA_XAUTH_CLIENT_SECRET", default=None)
+ # CSRF on by default, but only for WTF forms (not, eg, search, lookups, GET
+ # forms)
+ WTF_CSRF_CHECK_DEFAULT = True
+ WTF_CSRF_TIME_LIMIT = None
+
# protect cookies (which include API tokens)
if FATCAT_DOMAIN != "dev.fatcat.wiki":
SESSION_COOKIE_HTTPONLY = True