Add config option for cookie SameSite policy

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

1 files changed, 13 insertions, 12 deletions

diff --git a/docs/configuration.md b/docs/configuration.md
index a6f63168..2b3ccad1 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -69,18 +69,19 @@ these are rarely used for various reasons.
 | `urlAddPort`     | `CMD_URL_ADDPORT`     | **`false`** or `true`                                            | set to add port on callback URL (ports `80` or `443` won't be applied) (only applied when domain is set)          |
 | `allowOrigin`    | `CMD_ALLOW_ORIGIN`    | **`['localhost']`**, `['codimd.org']`, `[localhost, codimd.org]` | domain name whitelist (use comma to separate)                                                                     |
 
-## CSP and HSTS
-
-| config file | environment                   | **default** and example value                                                                                                              | description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| ----------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `hsts`      |                               | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}`                                                  | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year)                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-|             | `CMD_HSTS_ENABLE`             | **`true`** or `false`                                                                                                                      | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-|             | `CMD_HSTS_INCLUDE_SUBDOMAINS` | **`true`** or `false`                                                                                                                      | set to include subdomains in HSTS (default is `true`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-|             | `CMD_HSTS_MAX_AGE`            | **`31536000`**, `60 * 60 * 24 * 365`                                                                                                       | max duration in seconds to tell clients to keep HSTS status (default is a year)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-|             | `CMD_HSTS_PRELOAD`            | **`true`** or `false`                                                                                                                      | whether to allow preloading of the site's HSTS status (e.g. into browsers)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `csp`       |                               | `{"enable": true, "directives": {"scriptSrc": "trustworthy-scripts.example.com"}, "upgradeInsecureRequests": "auto", "addDefaults": true}` | Configures [Content Security Policy](https://helmetjs.github.io/docs/csp/). Directives are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. Some defaults are added to the configured values so that the application doesn't break. To disable this behaviour, set `addDefaults` to `false`. Further, if `usecdn` is on, some CDN locations are allowed too. By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `useSSL` is on. To change this behaviour, set `upgradeInsecureRequests` to either `true` or `false`. |
-|             | `CMD_CSP_ENABLE`              | **`true`** or `false`                                                                                                                      | whether to enable Content Security Policy (directives cannot be configured with environment variables)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-|             | `CMD_CSP_REPORTURI`           | **`undefined`**, `https://<someid>.report-uri.com/r/d/csp/enforce`                                                                         | Allows to add a URL for CSP reports in case of violations                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+## Web security aspects
+
+| config file    | environment                   | **default** and example value                                                                                                              | description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| -------------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `hsts`         |                               | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}`                                                  | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year)                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+|                | `CMD_HSTS_ENABLE`             | **`true`** or `false`                                                                                                                      | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+|                | `CMD_HSTS_INCLUDE_SUBDOMAINS` | **`true`** or `false`                                                                                                                      | set to include subdomains in HSTS (default is `true`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+|                | `CMD_HSTS_MAX_AGE`            | **`31536000`**, `60 * 60 * 24 * 365`                                                                                                       | max duration in seconds to tell clients to keep HSTS status (default is a year)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+|                | `CMD_HSTS_PRELOAD`            | **`true`** or `false`                                                                                                                      | whether to allow preloading of the site's HSTS status (e.g. into browsers)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `csp`          |                               | `{"enable": true, "directives": {"scriptSrc": "trustworthy-scripts.example.com"}, "upgradeInsecureRequests": "auto", "addDefaults": true}` | Configures [Content Security Policy](https://helmetjs.github.io/docs/csp/). Directives are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. Some defaults are added to the configured values so that the application doesn't break. To disable this behaviour, set `addDefaults` to `false`. Further, if `usecdn` is on, some CDN locations are allowed too. By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `useSSL` is on. To change this behaviour, set `upgradeInsecureRequests` to either `true` or `false`. |
+|                | `CMD_CSP_ENABLE`              | **`true`** or `false`                                                                                                                      | whether to enable Content Security Policy (directives cannot be configured with environment variables)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+|                | `CMD_CSP_REPORTURI`           | **`undefined`**, `https://<someid>.report-uri.com/r/d/csp/enforce`                                                                         | Allows to add a URL for CSP reports in case of violations                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `cookiePolicy` | `CMD_COOKIE_POLICY`           | **`strict`**, `lax` or `none`                                                                                                              | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | 
 
 ## Privacy and External Requests