Security hardening: enforce secure URLs and transport safeguards

2026-02-26 09:10:09 +00:00
parent 94c85fc8d5
commit 3ff5b7aa26
6 changed files with 185 additions and 11 deletions
@@ -127,6 +127,8 @@ This wrapper now delegates to `BlackWall\Auth\AuthClient`.
 - Store refresh tokens securely.
 - Keep access tokens out of logs and browser-visible output.
 - Use short session lifetimes where possible.
+- `Config::fromArray()` enforces HTTPS URLs by default.
+- For localhost-only development over HTTP, set `allowInsecureHttp => true`.

 ## Repository layout