Security hardening: enforce secure URLs and transport safeguards

2026-02-26 09:10:09 +00:00
parent 94c85fc8d5
commit 3ff5b7aa26
6 changed files with 185 additions and 11 deletions
@@ -124,3 +124,5 @@ try {
 - Rotate client secrets for confidential clients.
 - Validate `state` on every callback request.
 - Use secure session cookies (`Secure`, `HttpOnly`, `SameSite=Lax` or stricter).
+- HTTPS URLs are enforced by default in `Config::fromArray()`.
+- For localhost-only HTTP testing, explicitly set `allowInsecureHttp => true`.