Make cookies https-only if LOCAL_HTTPS is true, set X-Frame-Options to DENY,

add permissive CORS to API controllers

app/controllers/api_controller.rb

@@ -4,6 +4,7 @@ class ApiController < ApplicationController
   skip_before_action :verify_authenticity_token
 
   before_action :set_rate_limit_headers
+  before_action :set_cors_headers
 
   rescue_from ActiveRecord::RecordInvalid do |e|
     render json: { error: e.to_s }, status: 422
@@ -46,6 +47,13 @@ class ApiController < ApplicationController
     response.headers['X-RateLimit-Reset']     = (now + (match_data[:period] - now.to_i % match_data[:period])).to_s
   end
 
+  def set_cors_headers
+    response.headers['Access-Control-Allow-Origin']   = '*'
+    response.headers['Access-Control-Allow-Methods']  = 'POST, PUT, DELETE, GET, OPTIONS'
+    response.headers['Access-Control-Request-Method'] = '*'
+    response.headers['Access-Control-Allow-Headers']  = 'Origin, X-Requested-With, Content-Type, Accept, Authorization'
+  end
+
   def current_resource_owner
     User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token
   end

config/application.rb

@@ -36,5 +36,9 @@ module Mastodon
     config.to_prepare do
       Doorkeeper::AuthorizationsController.layout 'auth'
     end
+
+    config.action_dispatch.default_headers = {
+      'X-Frame-Options' => 'DENY'
+    }
   end
 end

config/initializers/session_store.rb

@@ -1,3 +1,3 @@
 # Be sure to restart your server when you modify this file.
 
-Rails.application.config.session_store :cookie_store, key: '_mastodon_session'
+Rails.application.config.session_store :cookie_store, key: '_mastodon_session', secure: (ENV['LOCAL_HTTPS'] == 'true')