framework:
    secret: '%env(APP_SECRET)%'
    http_method_override: false
    handle_all_throwables: true

    # Used only for the short-lived PKCE/state leg in AuthController
    # (/auth/login -> /auth/callback). App sessions are the separate
    # Redis-backed, sid-keyed store in App\Session\BffSessionStore.
    session:
        cookie_secure: true
        cookie_httponly: true
        cookie_samesite: 'lax'

    http_client: ~

    # Filesystem cache is sufficient here — used only to cache Keycloak's
    # JWKS in IdTokenDecoder, not for session state.
    cache:
        app: cache.adapter.filesystem