refactor(frontend): restrict insecure HTTP issuer to dev / explicit opt-in

2026-07-05 23:56:35 +02:00
parent b9d14412e6
commit 757c74b899
3 changed files with 11 additions and 6 deletions
@@ -16,5 +16,8 @@ SESSION_SECRET=change-me-to-a-long-random-string
 # SESSION_REFRESH_THRESHOLD_SECONDS=30
 # AUTH_FLOW_TTL_SECONDS=600

+# Dev already allows a plain-HTTP issuer. Set this only to allow it in a production build (never with a public issuer).
+# AUTH_ALLOW_INSECURE_HTTP=true
+
 # Backend API base URL (used from later parts)
 API_BASE_URL=http://localhost:5111