From 183e9a4303f22529b1cbd9f5a1464e110e3789e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= Date: Thu, 17 Sep 2026 21:05:59 +0200 Subject: [PATCH] fix: force https redirect --- config/packages/security.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/config/packages/security.yaml b/config/packages/security.yaml index 5d78b96..e296825 100644 --- a/config/packages/security.yaml +++ b/config/packages/security.yaml @@ -25,13 +25,13 @@ security: access_control: # The login surface itself has to stay reachable, or the entry point redirects in a loop. - - { path: ^/(login|auth|logout)$, roles: PUBLIC_ACCESS } - - { path: ^/auth/, roles: PUBLIC_ACCESS } + - { path: ^/(login|auth|logout)$, roles: PUBLIC_ACCESS, requires_channel: https } + - { path: ^/auth/, roles: PUBLIC_ACCESS, requires_channel: https } # Before the catch-all, or ROLE_EMPLOYEE would match ^/ first and the admin area would be # open to everybody. Order is the whole guard here. - - { path: ^/admin, roles: ROLE_ADMIN } + - { path: ^/admin, roles: ROLE_ADMIN, requires_channel: https } # Either role opens the app -- access_control treats a list of roles as an OR. Not # ROLE_USER: myep authenticates far more people than work here, and someone who holds # neither of these is refused at login with an explanation rather than let in to an # empty screen. - - { path: ^/, roles: [ROLE_EMPLOYEE, ROLE_ADMIN] } + - { path: ^/, roles: [ROLE_EMPLOYEE, ROLE_ADMIN], , requires_channel: https }