#428

backend/config/application.rb

@@ -31,5 +31,14 @@ module Backend
     # Middleware like session, flash, cookies can be added back manually.
     # Skip views, helpers and assets when generating a new resource.
     config.api_only = true
+    config.middleware.use ActionDispatch::Cookies
+    config.session_store :cookie_store,
+                         key: Rails.env.production? ? '__Host-btrc-session' : 'btrc-session',
+                         path: '/',
+                         secure: Rails.env.production?,
+                         httponly: true,
+                         same_site: :lax,
+                         expire_after: 20.years
+    config.middleware.use ActionDispatch::Session::CookieStore, config.session_options
   end
 end

backend/config/initializers/filter_parameter_logging.rb

@@ -4,5 +4,5 @@
 # Use this to limit dissemination of sensitive information.
 # See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
 Rails.application.config.filter_parameters += [
-  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc
-]
+    :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate,
+    :otp, :ssn, :cvv, :cvc, :code, :inheritance_code]

backend/config/routes.rb

@@ -56,12 +56,14 @@ Rails.application.routes.draw do
     member do
       get :exists
       get :diff
+      get :tag, action: :tag_reference
     end
   end
 
   resources :posts, only: [:index, :show, :create, :update] do
     collection do
       get :metadata
+      get :tag_filters
       post :bulk
       get :random
       get :versions, to: 'post_versions#index'
@@ -100,7 +102,9 @@ Rails.application.routes.draw do
     collection do
       post :verify
       get :me
-      get :session
+      get :session, action: :show_session
+      get :csrf
+      delete :session, action: :destroy_session
       post 'code/renew', action: :renew
     end
   end