document login, short-lived tokens and secure cookie configurations

2019-02-05 21:10:56 +01:00
parent 3c2fd02bc0
commit 80d0943d9d
2 changed files with 40 additions and 0 deletions
@@ -287,6 +287,14 @@ Default is `false`.

 Define a white list of allowed ips/domains to use in data sources. Format: `ip_or_domain:port` separated by spaces

+### cookie_secure
+
+Set to `true` if you host Grafana behind HTTPS. Default is `false`.
+
+### cookie_samesite
+
+Sets the `SameSite` cookie attribute and prevents the browser from sending this cookie along with cross-site requests. The main goal is mitigate the risk of cross-origin information leakage. It also provides some protection against cross-site request forgery attacks (CSRF),  [read more here](https://www.owasp.org/index.php/SameSite). Valid values are `lax`, `strict` and `none`. Default is `lax`.
+
 <hr />

 ## [users]